 <p>I am still at education so do know how good is my solution , but i did not crash so hope it is correct</p> <p>and it is quite similar to @muthu 's code</p> <p>I had used JPA-eclipselink and Struts2</p> <p>Action Class</p> <pre><code>String checkLogin = "SELECT user FROM UserEntity user WHERE user.username = :username AND user.password = :password"; Query checkLoginQuery = em.createQuery(checkLogin); checkLoginQuery.setParameter("username", loginUsername); checkLoginQuery.setParameter("password", loginPassword); userEntity = (UserEntity) checkLoginQuery.getSingleResult(); Map sessionMap = ActionContext.getContext().getSession(); sessionMap.put("userEntity", userEntity); </code></pre> <hr> <p>JSP -> all jsp pages have this(bug:affected if session is not killed when browser is not closed )</p> <pre><code>&lt;%@ taglib prefix="s" uri="/struts-tags" %&gt; &lt;s:if test="%{#session.userEntity == null}"&gt; &lt;jsp:forward page="login.jsp"/&gt; &lt;/s:if&gt; </code></pre> <hr> <hr> <p>Correct me if I am wrong</p> <p><a href="http://www.theserverside.com/discussions/thread.tss?thread_id=22795" rel="nofollow">Quoting this page</a></p> <blockquote> <p>Both and RequestDispatcher.forward() are what I refer to as "server-side" redirects</p> <p>The response.sendRedirect() is what I call a "client-side" redirect.</p> </blockquote> <p>so a server side forward looks more safe to me , maybe I am wrong (I am sorry if I am miss interpreting it ,not worked in real life projects yet)</p>