title: JSF HTTP Session Login
body: <p>I try to create login form in web application.
  in JSP page I can use</p>
  
  <pre><code>&lt;%
     String name = request.getParameter( "username" );
     session.setAttribute( "theName", name );
  %&gt;
  </code></pre>
  
  <p>but now I am using JSF /Facelets  for web application 
  I don't know how to create session in JSF Backing bean for client and check if user is logged in or not so it will redirect into login page.
  who can help me give me link tutorial for these problem ?
  thank you before</p>
  
  <p>Now I have little problem with mapping into web.xml
  code snipped of class Filter</p>
  
  <pre><code>@Override
  public void init(FilterConfig filterConfig) throws ServletException {
      this.config = filterConfig;
  }
  
  @Override
  public void doFilter(ServletRequest request, ServletResponse response,
          FilterChain chain) throws IOException, ServletException {
      HttpServletRequest req = (HttpServletRequest) request;
      HttpServletResponse res = (HttpServletResponse) response;
      LoginController controller = (LoginController) req.getSession()
              .getAttribute("loginController");
      if (controller == null || !controller.isLoggedIn()) {
          res.sendRedirect("../admin/login.xhtml");
      } else {
          chain.doFilter(request, response);
      }
  }
  </code></pre>
  
  <p>and in <code>web.xml</code> I map with <code>&lt;fitler&gt;</code> tag</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;userLoginFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;com.mcgraw.controller.UserLoginFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;loginPage&lt;/param-name&gt;
          &lt;param-value&gt;/login.xhtml&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;userLoginFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>I have one folder admin in web project and I check if the user is not logged in with admin permission to not access page (I can do the permission check) but when I use the filter the browser doesn't understand url ??
  no StackTrace show when the browser doesn't understand url</p>
  
  <p>Error shown on Firefox</p>
  
  <pre><code>The page isn't redirecting properly
  </code></pre>
  
  <p>on IE it loading ... loading . ..  non-stop</p>
  
  <p>now I change condition which check if req.getPathInfo.startsWith("/login.xhtml") it will do chain</p>
  
  <p>I have 2 idea but it response 500 HTTP STATUS </p>
  
  <pre><code> if (controller == null || !controller.isLoggedIn()) {
       res.sendRedirect("../admin/login.xhtml");
       if(req.getPathInfo().startsWith("/login.xhtml")){
       chain.doFilter(request, response);
  }
  
  } else {
       chain.doFilter(request, response);
  }
  </code></pre>
  
  <p>===============</p>
  
  <pre><code>if (controller == null || !controller.isLoggedIn()) {
      if (!req.getPathInfo().startsWith("/login.xhtml")) {
          res.sendRedirect("../admin/login.xhtml");
      } else {
          chain.doFilter(request, response);
      }
  } else {
      chain.doFilter(request, response);
  }
  </code></pre>
  
  <p>======================
  update Class loginController</p>
  
  <pre><code>package com.mcgraw.controller;
  
  import com.DAO.UserBean;
  import com.entity.IUser;
  import java.io.Serializable;
  import javax.ejb.EJB;
  import javax.faces.bean.ManagedBean;
  import javax.faces.bean.SessionScoped;
  
  /**
   * @author Kency
   */
  @ManagedBean
  @SessionScoped
  public class LoginController implements Serializable {
  
      @EJB
      private UserBean userBean;
      private IUser user;
      private boolean admin;
      private boolean mod;
      private PasswordService md5;
  
      /** Creates a new instance of LoginController */
      public LoginController() {
          user = new IUser();
          md5 = new PasswordService();
      }
  
      // getter / setter
      public boolean isMod() {
          return mod;
      }
  
      public void setMod(boolean mod) {
          this.mod = mod;
      }
  
      public IUser getUser() {
          return user;
      }
  
      public void setUser(IUser user) {
          this.user = user;
      }
  
      public boolean isAdmin() {
          return admin;
      }
  
      public void setAdmin(boolean admin) {
          this.admin = admin;
      }
  
      public String cplogin() {
          String md5Password = md5.md5Password(user.getPassword());
          if (userBean.userLogin(user.getUsername(), md5Password) != null) {
              if (user.getUsername() != null || md5Password != null) {
                  user = userBean.userLogin(user.getUsername(), md5Password);
                  if (user.getGroups().getAdmin() != null) {
                      setAdmin(user.getGroups().getAdmin());
                  }
                  if (user.getGroups().getMods() != null) {
                      setMod(user.getGroups().getMods());
                  }
                  if (isAdmin() == true || isMod() == true) {
                      return "home";
                  } else {
                      return "login";
                  }
              } else {
                  return "login";
              }
          } else {
              return "login";
          }
      }
  
      public String logout() {
          user = null;
          return "login";
      }
  
      public boolean isLoggedIn() {
          return user != null;
      }
  }
  </code></pre>
  
  <p>I have new problem if render JSF taglib with method loggedIn, in index page (not in admin folder) user doesn't login can see what I render example,  &lt;== this like if user doesn't login user can't see but why can he see it?</p>