title: j_security_check called directly
body: <p>I have a web application, and I want the home page to include a login form, among other data. If the user choose to log in, he should be redirected to another page (e.g. login_success.jsp). My question is: may I use j_security_check mechanism for logging in or the only way is to use a managed bean to take care of the login?</p>
  
  <p>my home page looks like this:</p>
  
  <pre><code>....
      &lt;form action="j_security_check" method="POST" name="loginForm"&gt;
          &lt;h:panelGrid columns="2"&gt;
              &lt;h:outputLabel id="userNameLabel" for="j_username" value="#{label.home_username}:" /&gt;
              &lt;h:inputText id="j_username" autocomplete="off" /&gt;
              &lt;h:outputLabel id="passwordLabel" for="j_password" value="#{label.home_password}:" /&gt;
              &lt;h:inputSecret id="j_password" autocomplete="off" /&gt;
  
              &lt;h:panelGroup&gt;
                  &lt;h:commandButton type="submit" value="Login" /&gt;
                  &lt;h:commandButton type="reset" value="Clear" /&gt;
              &lt;/h:panelGroup&gt;
          &lt;/h:panelGrid&gt;
      &lt;/form&gt;
  ...
  </code></pre>
  
  <p>if I press login button, I get -> HTTP Status 400 - Invalid direct reference to form login page. and it's obvious, j_security_check mechanism doesn't know where to "redirect", since I didn't request a protected resource before.</p>