When I click the command button on the page below navigations fails. (Clicking on the button refreshes the page, removes the URL parameter and displays the required error me
I'll assume that the update="form"
is a careless oversimplification and that you actually meant to use render="@form"
and confused it with PrimeFaces or so.
Coming back to the concrete problem, that's caused by performing a non-ajax postback which triggers the processing of view parameters as well.
Either make it required on non-postback only (make sure that the bean is view scoped though),
<f:viewParam ... required="#{not facesContext.postback}" />
or pass it on postback as well
<h:commandButton ...>
<f:param name="product" value="#{bean.product}" />
</h:commandButton>
or use OmniFaces <o:viewParam> instead if you're already using a view scoped bean. It won't process the view parameter on postbacks.
<... xmlns:o="http://omnifaces.org/ui">
...
<o:viewParam ... />