title: JSF / Java EE form vs programmatic authentication
body: <p>I have been experimenting with the substance of this question (<a href="https://stackoverflow.com/questions/13605277/jsf-java-ee-login-without-requiring-a-protected-resource">JSF / Java EE login without requiring a protected resource</a>). </p>
  
  <p>If I set up a sample application using BASIC authentication, with one public page (/public.xhtml), and one protected page (/protected/private.xhtml), and I have a link from the first page to the second (as shown below), everything works perfectly.</p>
  
  <pre><code>&lt;h:commandButton value="Go Private" action="/protected/private?faces-redirect=true" /&gt;
  </code></pre>
  
  <p><br />However, if I remove the <code>login-config</code> and replace the above button with:</p>
  
  <pre><code>&lt;h:commandButton value="Go Private" action="#{mybean.login}" /&gt;
  </code></pre>
  
  <p><br />...and #{mybean.login} looks something like this...</p>
  
  <pre><code>public String login() {
      HttpServletRequest request = ...
      try {
          request.login("known username", "known password");
      } catch (Exception e) {
          // handle unknown credentials
      }
      return "/protected/private?faces-redirect=true";
  }
  </code></pre>
  
  <p><br />In this case, the login succeeds (no exception from <code>request.login()</code>), but the browser shows a "forbidden resource" page.</p>
  
  <p><br />Can anyone shed any light on the difference between the two scenarios?</p>