I have a page with an input text component marked as required="true"
and having a custom Validator
in server side.
Now as a client, I submit the page without the HTML element rendered by that component (this can be easily achieved by removing the element from the DOM tree using browser's builtin DOM element inspector). The form is successfully submitted, without the server side validation of this required component.
Is this as per JSF specification? Is there a way to specify that the validators in the page are to be executed even if the posted page do not contain them?
This is as per the specification. Here's an extract of relevance from
UIInput#validate()
javadoc:An empty input will send an empty string, not
null
. A complete absence of the input will sendnull
, not empty string.Whether that is harmful or not depends on the business logic. A decently designed model (business logic and/or data model) which doesn't consider
null
as expected case would cause a null pointer exception elsewhere, or a SQL constraint violation (NOT NULL
), which will usually end up in a HTTP 500 error response. But if the model actually considersnull
as an expected case, then it's likely a fault in the model. The view (the JSF page), intented to merely present the model, can then do little against it.If the business logic or data model can really not be altered to consider
null
as an exceptional case (i.e. never assume/accept the given value asnull
), and you happen to use JPA, then your best bet is to add a@NotNull
on the property. Whilst JSF will bypass validation on it, JPA will still validate it, causing still an exception and a HTTP 500 error. I'd in this case only wonder why the DB column doesn't have aNOT NULL
constraint in first place. Alternatively, do class level validation.Noted should be that MyFaces logs a warning like below on this: