This paper sheds light on the findings of security testing of Java
Server Faces. JSF has been widely used as an open source web framework
for developing efficient applications using J2EE. JSF is compared with
ASP.NET framework to unearth potential security flaws.

Download PDF
http://www.secniche.org/jsf/dissecting_jsf_pt_aks_kr.pdf