ViewExpiredException after upgrade to jsf2

Question

We recently upgraded a major platform from jsf 1.2 to 2.0. After upgrading we're getting several ViewExpiredException errors each hour. From reading up on the topic it seems that this is an expected exception when sessions expire, however we've reviewed the access logs and we are getting these exceptions even when requests are only 5 minutes apart in some cases.

My questions are as follows:

1) Other than session expiration, what other conditions might cause ViewExpiredException?

2) The exception we're logging doesn't contain much detail about the exact condition that is causing the exception (missing session, corrupt session, unable to restore a particular component). Is there a way to introduce additional logging to find out the very specific situation that is triggering this exception in each case?

Mojarra 2.0.4-b09 Tomcat 6 Using Memcached Session Manager for session replication

Any help is appreciated. Thanks!

Answer 1

Other than session expiration, what other conditions might cause ViewExpiredException?

The enduser has requested/created too much views within a session and is submitting to an old view. The default max views per session is 15. In other words, if the enduser opens 16 browser windows/tabs on a page with a form within the same session and submits to the first one, then the user can get ViewExpiredException.

The max views per session is configureable in web.xml by

<context-param>
    <param-name>com.sun.faces.numberOfViewsInSession</param-name>
    <param-value>15</param-value>
</context-param>

See also Mojarra FAQ for other parameters.

---

Is there a way to introduce additional logging to find out the very specific situation that is triggering this exception in each case?

Not through JSF and/or a ViewExpiredException. The whole exception just means that the view is not present in the session anymore. This can in turn indeed have more underlying causes. Logging the session creation and destroy using a HttpSessionListener and logging the session attribute modifications by HttpSessionAttributeListener may be helpful.

---

Update as per the comments, pressing the browser back button on a cached page containing a form and then submitting the form thereafter could indeed also cause ViewExpiredException when the view is been expired. This can be solved in following two ways, preferably in a combination of them:

• Instruct the browser to not cache the pages.
• Do not use POST forms for plain page-to-page navigation.

For more detail, see this answer.