title: Setting the header referrer on Primefaces action
body: <p>This is a follow up to a previous question: <a href="https://stackoverflow.com/questions/51861619/error-using-jsf-protected-views-when-opening-a-new-tab/51881009#51881009">Error using JSF protected views when opening a new tab</a></p>
  
  <p>I am using faces-config protected views to protect against CSRF. I ran into problems earlier with links opened in a new tab that I resolved by adding </p>
  
  <pre><code>rel="noopener noreferrer"
  </code></pre>
  
  <p>to all new tab links.</p>
  
  <p>But now I' running into the same issue with commandButtons. </p>
  
  <p>I have</p>
  
  <pre><code>        &lt;p:commandButton value="Submit" 
              action="#{bean.submit}" /&gt;
  </code></pre>
  
  <p>And submit() returns a string with the new view. But I still get the following error:</p>
  
  <pre><code>javax.faces.application.ProtectedViewException: JSF1099: Referer [sic] header value http://.../updatestatus.xhtml?javax.faces.Token=1534516398157&amp;cr=45309 does not appear to be a protected view. Preventing display of viewId /finance/commitmentregister/view.xhtml
  at com.sun.faces.lifecycle.RestoreViewPhase.maybeTakeProtectedViewAction(Unknown Source)
  </code></pre>
  
  <p>Is there a way to set no referer or opener on the Primefaces commandbutton?</p>
  
  <p>Edit:</p>
  
  <p>Maybe not the answer I was looking for, but I got around the problem by adding a servlet request wrapper in a filter to return null when asked for the referer.</p>
  
  <p>Further edit:</p>
  
  <p>Adding the rough outline of how my code looks with the wrapper fix:</p>
  
  <pre><code>@WebFilter(filterName = "UserLoginFilter", urlPatterns = { "*.xhtml" })
  public class UserLoginFilter implements Filter {
  
  @Override
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
          throws IOException, ServletException {
  
      HttpServletRequestWrapper wrapper = new HttpServletRequestWrapper(httpServletRequest) {
          @Override
          public String getHeader(String name) {
              if (name.equalsIgnoreCase("referer")) {
                  return null;
              } else {
                  return super.getHeader(name);
              }
          }
      };
  
      chain.doFilter(wrapper, response);
  }
  
  }
  </code></pre>