We have been securing our backing bean methods using a custom @Secure interceptor to prevent forged invocations of the method.

But recently, it hit me that these methods are not reachable if the component invoking the action is not rendered. It is my understanding that JSF will generate the view, and if the component is not rendered based on permissions (e.g. EL with isUserInRole), then any forged POST with that component as the source will not fire because the component will not be found in the restored view. Is this correct?

Essentially, any forgery would have to have a compromised and current JSESSIONID and perhaps even ViewState depending on whether they needed the same view.

Can someone please confirm that my assumptions are correct and, if possible, point me to a place in the spec? 

Thanks