h:inputSecret getter method not being called

Question

Versions :

Aapche MyFaces 2.1.14

RichFaces 4.3.5

Issue :

I am facing very strange issue for tag. As shown in below code , when from is renderd for the first time , bean.getPassword method should be called.

But it seems that this method is not getting called when form is rendered for the first time (before post back is made ). I have verified it by debugging. Strangely , if I put the EL of the h:inputSecret elsewhere in the page , this method does get called

I am really getting stuck as why is this happening ? Has anybody came across such an issue ?

Code :

<h:form prependId="false">

        <!-- check whether getter is called , it gets called in this case -->

    #{bean.password}

    <h:panelGrid columns="2">

            <h:outputText value="User ID:"/>
            <h:inputText value="#{bean.userId}"/>


            <h:outputText value="Password:"/>
            <h:inputSecret id="passwd1" name="passwd1" required="true" value="#{bean.password}"
                                requiredMessage="Password is required"/>

    <h:panelGrid>


</h:form>

BalusC BalusC · Accepted Answer · 2014-08-19T09:33:34

By default, <h:inputSecret> doesn't redisplay the model value for security reasons (the raw password is namely visible in generated HTML source). You'd need to explicitly set its redisplay attribute to true. See also the tag documentation (emphasis mine):

Render the clientId of the component as the value of the "name" attribute. Render the current value of the component as the value of the "value" attribute, if and only if the "redisplay" component attribute is the string "true". If the "styleClass" attribute is specified, render its value as the value of the "class" attribute.

So, this should do:

<h:inputSecret ... redisplay="true" />

I hope that you're aware of the security implications. You'd usually only do this when the form is submitted with validation errors on other fields to avoid the user annoyance of re-entering the (valid?) password. Something like this:

<h:inputSecret ... redisplay="#{facesContext.postback and component.valid}" />

h:inputSecret getter method not being called

1 Answers