I found out that the JSF 2.0 Flash scope is implemented in Mojarra 2.x via a cookie. What seems to happen is that when navigating from view A to view B using The Flash, JSF sends a redirect response. It is this same response that contains the set-cookie header.
As cookies are global for the browser, I wonder what the chances are that this leads to a race condition. As the cookie is set during the redirect response, I tried to find if the HTTP spec somehow guarantees that the request that the browser issues in response is always the first to utilize this cookie.
In general however, there might still be a problem if this first request is somehow stalled (since the Internet decided to route that particular request half way around the world), and then a second request originating from another tab arrives at the server first.
Isn't a cookie a terrible idea to use for a flash scope between two pages, or am I overlooking something and is it perfectly safe?