title: Can I skip HttpServletRequest.login() and just put authed User in the Session?
body: <p>Assuming i dont have any 'password protected' pages, but sometimes need to know which user clicked some jsf-button, is the below okay, or should I also use HttpServletRequest.login()</p>
  
  <p>some managed bean that handles logins:</p>
  
  <pre><code>public void login(String name, String password) {
      try { 
          HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
          MyUser user = userEjb.login(name, password);
          request.getSession().setAttribute("user", user);
      } catch {
      //login failed message..
  
      }
  }
  </code></pre>
  
  <p>method invoked by h:commandButton:</p>
  
  <pre><code>public void doSomething() {
          HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
          MyUser user = request.getSession().getAttribute("user");
          //Is the user object 'safe' here?
  }
  </code></pre>