You always keep client state on the server in the sense that the DB keeps track of sessions and the server keeps track of caching. Never trust the state of the

You always keep client state on the server in the sense that the DB keeps track of sessions and the server keeps track of caching. Never trust the state of the client... Never trust client's input... No idea what JSF is. Sorry it didn't give you access to the data you needed when you rendered files.