Initialization of List in a JSF Managed bean

If it's a managed bean as you say, you should do this in a method annotated with @PostConstruct

public class Person {
    private List<String> friends;
    @PostConstruct
    public void init(){
         friends = new ArrayList<String>();
    }

    //getter and setter...
}

1. The practice of doing any initialization in the getter and setter is generally frowned upon within the context of JSF. See Why JSF calls getters multiple times

2. Also, per the API for @PostConstruct, the contract specifies safety features and guarantees that if an exception is thrown in a method annotated as such, the bean should not be put into service. There are no such guarantees on a plain constructor.

3. In a managed bean, injection happens immediately after construction. This means that any operations you're carrying out in the constructor cannot depend on any injected resources (via @ManagedProperty). Whereas in a @PostConstruct method, you'll have access to all the resources declared on the managed bean

EDIT: It's important to note that there can be only one @PostConstruct for any @ManagedBean, so all important initializations should happen in there.

It's also worthwhile to note that, while the @PostConstruct method is the ideal place to initialize a backing bean variable/List, there are implications regarding the scope of the managed bean

1. @RequestScoped: In a managed bean with this annotation, the method will be called per submit of the JSF view concerned. A @RequestScoped bean is destroyed and recreated with every request, The implication of this is that depending on your setup, the list initialized in the @PostConstruct may be reset to empty or default values during each request. Under certain circumstances, conversion errors may occur as a result of the re-initialization of the list mid-JSF request.

2. @ViewScoped: In a managed bean with this annotation, you're guaranteed to have the @PostConstruct method run once, if and only if you're dealing with the same instance of the @ViewScoped bean. If the viewscoped bean is destroyed and recreated, the @PostConstruct method will run again.

3. @SessionScoped: A bean with this annotation is created once and stays alive until the user's HTTP session ends. In this scenario, the @PostConstruct method is guaranteed to run once and only once until the bean is destroyed

See also

• https://stackoverflow.com/a/3406631/1530938

I would suggest this:

public class Person {
     //other fields...
     private List<String> friends=new ArrayList<>();

     // returns a copy to protect original list
     public List<String> getFriends() {
        Collections.unmodifiableList(new ArrayList<>(friends));
     }
     public void addFriend(String> friend) {
        this.friends.add(friend);
     }
     public void addFriends(List<String> friends) {
        this.friends.addAll(friends);
     }
}