JSF login form - only store session when login is successful - jsf

Question

I have already a login functional screen built using JSF 2.2 and PrimeFaces 5.3. However, I have a problem. Say the user enters username and password but one of them is incorrect. When that happens, I display an error message to the user: "Username and/or password is incorrect". The problem is that at that moment I am storing the session. I ONLY want to store a session once the user successfully is logged in. My Login form looks like this:
<f:metadata>
<f:viewParam name="tipo" value="#{loginTipoController.tipo.tipo}" />
</f:metadata>
<h:form id="login">
<p:focus context="login" />
<p:graphicImage url="img/logog.JPG" width="448" height="119" />
<p>Digite su usuario y password.</p>
<p:outputLabel for="usuario" value="Usuario:" />
<p:inputText id="usuario" value="#{loginController.login.username}" />
<p:outputLabel for="password" value="Password:" />
<p:password id="password" value="#{loginController.login.password}" />
<p:messages autoUpdate="true" for="usuarioPassword" />
<p:commandButton value="Login" action="#{loginController.login()}" />
<p:button value="Regresar" outcome="index.jsf" />
</h:form>
The controller class (loginController), looks like this:
#ManagedBean
#SessionScoped
public class LoginController {
private Login login;
private LoginTipo loginTipo;
private LoginService service;
public Login getLogin() {
return login;
}
public void setLogin(Login login) {
this.login = login;
}
public LoginService getService() {
return service;
}
public void setService(LoginService service) {
this.service = service;
}
#PostConstruct
public void init()
{
login = new Login();
service = new LoginService();
}
public String login()
{
FacesContext facesCont = FacesContext.getCurrentInstance();
loginTipo = facesCont.getApplication().evaluateExpressionGet(facesCont,
"#{loginTipoController.tipo}", LoginTipo.class);
login = service.login(login.getUsername(), login.getPassword(), loginTipo.getTipo());
if(login.getMensaje_id() != 0)
{
FacesContext.getCurrentInstance().addMessage("usuarioPassword",
new FacesMessage(login.getMensaje()));
ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
ec.invalidateSession();
return "";
}
else
{
return login.getMensaje();
}
}
//logout method
public void logout()
{
ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
ec.invalidateSession();
try
{
ec.redirect(ec.getRequestContextPath() + "/index.jsf");
}
catch (IOException e)
{
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
I am not putting the LoginService() class code because it is simply going to the database and checking if the user exists or not. I just want to know what do I need to do so that the session is only stored when the user successfully logs in.
Notice that on the login() method of the controller class, when the user fails to log in, I display an error message. After that, I have the following piece of code:
ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
ec.invalidateSession();
I am destroying the session. I want to avoid to have to do that!

Answer 1

I understand that you basically want to clear out the login form on login fail. You could just clear out the bean properties representing form data.
login = new Login();
loginTipo = null;
The bean itself does not necessarily need to be session scoped. It can be request scoped and you could manually put the user object in session. I understand Login represents the user. In that case, once the login is successful, do as follows:
ec.invalidateSession();
ec.getSessionMap().put("login", login);
return "/userhome?faces-redirect=true";
The logged-in user will be available in the session scope as #{login}.
Explicitly invalidating the session right before login is a good security practice to avoid session fixation attacks. Invalidating it on every login fail is indeed unnecessary.