Version 2.2.6 of the JSF reference implementation contains a fix for making the com.sun.faces.renderkit.ByteArrayGuard class cluster-aware by allowing the specification of a ClientSideSecretKey parameter accessible via a JNDI lookup in the following code (lines 212 to 222) from the setupKeyAndMac() method of the ByteArrayGuard class.

The InitialContext class is not on the JRE whitelist for the Google App Engine platform, so a NoClassDefFoundError exception is thrown. To address this issue, I propose an approach that is similar to what was done with lines 805 to 816 of the WebConfiguration class (the processJndiEntries method).

• https://java.net/jira/browse/JAVASERVERFACES-3258
• https://code.google.com/p/googleappengine/issues/detail?id=5280
• Make ByteArrayGuard cluster aware
• ViewState encryption: ByteArrayGuard is not thread safe / Does Not Take Into Account Session Failover

Copyright © 2014, Wildstar Technologies, LLC.