来自红帽官方支持：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">
...
    <env-entry>
        <env-entry-name>jsf/FlashSecretKey</env-entry-name>
        <env-entry-type>java.lang.String</env-entry-type>
        <!-- http://www.digitalsanctuary.com/aes-key-generator.php -->
        <env-entry-value>Ya+MAlSDzgC3LAXgfEoPA/J6saEp7MtjjF0P6LP69nGk=</env-entry-value>
    </env-entry>
    <distributable/>
</web-app>

jsf/FlashSecretKey是base64编码的AES 256位密钥，用于加密闪存范围cookie，如csfcfc=K8auYBA%3D;.密钥可以由下面的代码生成：

import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
public class Main {
    public static void main(String ... args) throws NoSuchAlgorithmException {
        KeyGenerator keyGen = KeyGenerator.getInstance("AES");
        keyGen.init(256); // key length is 256 byte
        SecretKey secretKey = keyGen.generateKey();
        System.out.println("key: " + Base64.getEncoder().encodeToString(secretKey.getEncoded()));
    }
}

Flash Cookie值Set-Cookie：这是一个很好的例子。如果JNDI密钥java：comp/env/jsf/FlashSecretKey未设置，Mojarra将尝试创建一个随机密钥，用于Flash cookie值的AES加密。
在群集环境中，该行为将导致每个群集EAP示例具有不同的密钥。因此，Mojarra无法还原群集闪存cookie值，并显示以下错误消息：

20:09:40,317 SEVERE [javax.enterprise.resource.webcontainer.jsf.flash] (default task-1) 
JSF1094: Could not decode flash data from incoming cookie value Invalid characters in decrypted value.  Processing will continue, but the flash is unavailable for this request.