title: Best way to log in, log out, and store session attributes in JSF
body: <p>I am very new to JSF, and I am pretty confused about the best practices of managing user logins. There are a lot of answers floating around, but they require knowledge of JSF and Java EE which I don't seem to have. </p>
  
  <p>When working with a classic JSP project, I handle logins in a very simple way. When a user successfully logs in, a session attribute "isLoggedIn" is created with the value true. When the user logs out, the session is invalidated. If the "isLoggedIn" attribute is either false or missing, pages that require you to be logged in redirect to the login screen.</p>
  
  <p>How would this sort of thing be done in JSF? Should I store things like login status, username, and user role in an HttpSession, or in a managed session bean?</p>
  
  <p>A lot of answers that I found say that you should use request.getRemoteUser() to manage logins, but don't give any further explanation. From what I was able to gather, this method is useful if you are using domain credentials to log into the application. So is it of any use if I'm storing user credentials (username + salted and hashed password) in a database?</p>
  
  <p>It would be very helpful if someone can show me how a website with the following two pages would work:</p>
  
  <ol>
  <li>A login page where one can enter a username and password and press a "Login" button.</li>
  <li>A page with the message "Login Successful", and a logout button. When the log out button is pressed, the user is logged out and brought to the login page.</li>
  </ol>
  
  <p>If a user tries to go to the second page while they are not logged in, they will be redirected to the first page.</p>
  
  <p>Like I said before, I am very new to JSF and I simply cannot find a good tutorial for how to handle this sort of thing. So any links that you feel are useful will be appreciated.</p>
  
  <p>If it matters, I am using the MyFaces implementation, and the PrimeFaces component library.</p>