Package com.vaadin.flow.component.trigger.internal

Class SetAttributeAction<T>

java.lang.Object
com.vaadin.flow.component.trigger.internal.Action
com.vaadin.flow.component.trigger.internal.SetAttributeAction<T>
Type Parameters:
T - the runtime type of the value to assign — the DOM coerces it to a string when setting the attribute
All Implemented Interfaces:
Serializable
public class SetAttributeAction<T> extends Action
Assigns a value to an HTML attribute on a target element when the bound trigger fires.

Attributes differ from JS properties (see SetPropertyAction): attributes live in the markup-facing namespace (id, class, data-*, ARIA attributes such as aria-hidden) and their values are always strings in the DOM. A null value at fire time removes the attribute via removeAttribute, matching the way the DOM models "attribute is absent".

The value to assign can be either a literal (constant, serialised at build time) or an Action.Input that produces the value on the client when the trigger fires.

Common idioms:

  • Set an ARIA flag: new SetAttributeAction<>(panel, "aria-hidden", "true")
  • Remove an attribute: new SetAttributeAction<>(input, "disabled", (String) null)
  • Mirror a value from another component: new SetAttributeAction<>(target, "data-source", new PropertyInput<>(field, "value", String.class))

Server-state mirror (opt-in)

By default, this action runs client-only: the attribute is assigned (or removed) in the browser and the server's view of the attribute is not updated. As a result, Element.getAttribute(String) on the target keeps returning whatever the server last set, which will drift from what the user sees in the browser. Call mirrorToServer() to opt into mirroring the assigned value back into the target's ElementAttributeMap so the server-side view tracks the browser. The server-side update produced by the mirror does not generate another client-bound change, so there is no echo round-trip.

Security implication of mirrorToServer(): when the mirror is enabled, the value the server stores is whatever the client sent. An end user with the browser devtools open can substitute any value for the one this action would normally compute. Server-side code must not rely on the mirrored attribute value as a trusted source of truth for authorisation, validation, or any other security-sensitive decision; treat it the same way you would treat any other client-originated input. If you need a trusted server-side value, derive it on the server (e.g. via a CallbackAction that recomputes from session state) rather than trusting the mirror. This caveat is the reason the mirror is opt-in: the safe default never trusts a client-set value.

For internal use only. May be renamed or removed in a future release.

See Also:

  • Constructor Details

    • SetAttributeAction

      public SetAttributeAction(Component target, String attributeName, @Nullable T value)
      Creates an action that assigns the given literal value to the given attribute on target when the trigger fires. Passing null removes the attribute (renders target.removeAttribute(name);).
      Parameters:
      target - the component whose root element to modify, not null
      attributeName - the attribute name, not null
      value - the value to assign — typically a String; any value is coerced to a string by the DOM. null removes the attribute.

    • SetAttributeAction

      public SetAttributeAction(Component target, String attributeName, Action.Input<? extends T> source)
      Creates an action that assigns the value produced by source to the given attribute on target when the trigger fires. A null produced by the source removes the attribute.
      Parameters:
      target - the component whose root element to modify, not null
      attributeName - the attribute name, not null
      source - input that produces the value to assign, not null

  • Method Details

    • mirrorToServer

      public SetAttributeAction<T> mirrorToServer()
      Opts into the server-state mirror: when the trigger fires, the assigned value (or the removal) is forwarded back to the server and stored on the target's ElementAttributeMap so Element.getAttribute(String) returns the same value the browser sees.

      See the class Javadoc for the security implication — the server stores whatever the client sent, so the mirrored value is not trustworthy for authorisation or validation decisions.

      Must be called before this action is wired through Trigger.triggers(Action...); configuration changes after wiring do not affect the already-installed client JS.

      Returns:
      this action, for chaining

    • toJs

      protected JsFunction toJs(Trigger trigger)
      Description copied from class: Action
      Builds the JsFunction that runs this action when the surrounding trigger fires. The returned function takes one runtime argument named event (declared by the framework when it composes the trigger handler); subclasses do not declare argument names themselves.

      The body is one statement. To embed a value produced on the client, capture an Action.Input's JsFunction as a capture and invoke it inside the body as $N(event).

      Specified by:
      toJs in class Action
      Parameters:
      trigger - the surrounding trigger this render is for, not null
      Returns:
      the action's JS function, not null