title: Should <protected-views> be used for JSF 2.2 CSRF protection?
body: <p>I am confused.
  I see that JSF 2.0 has implicit CSRF protection:
  <a href="https://stackoverflow.com/questions/8704612/how-jsf-2-0-prevents-csrf">How JSF 2.0 prevents CSRF</a></p>
  
  <p>On the other side according to the article <a href="http://www.oracle.com/webfolder/technetwork/tutorials/obe/java/JSF-CSRF-Demo/JSF2.2CsrfDemo.html" rel="noreferrer">http://www.oracle.com/webfolder/technetwork/tutorials/obe/java/JSF-CSRF-Demo/JSF2.2CsrfDemo.html</a> we should add the following element to the <code>faces-config.xml</code> file with the list of JSF pages.</p>
  
  <pre><code>&lt;protected-views&gt;
     &lt;url-pattern&gt;/csrf_protected_page.xhtml&lt;/url-pattern&gt;
  &lt;/protected-views&gt;
  </code></pre>
  
  <p>Should <code>&lt;protected-views&gt;</code> be used for JSF 2.2 CSRF protection?</p>