Javaサーブレットでログイン・ログアウト機能を実装する方法【フィルターで未ログイン時のアクセス制限】

package controller;

import java.io.IOException;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import model.StoreDao;

public class LoginCon extends HttpServlet {
    private static final long serialVersionUID = 1L;

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String userId = request.getParameter("userId");
        String password = request.getParameter("password");

        // デバッグ用出力
        System.out.println("入力されたユーザーID: " + userId);
        System.out.println("入力されたパスワード: " + password);

        // 認証処理
        StoreDao userDao = new StoreDao();
        boolean isAuthenticated = userDao.authenticate(userId, password);

        if (isAuthenticated) {
            HttpSession session = request.getSession();
            session.setAttribute("userId", userId);
            response.sendRedirect("ListCon"); // ログイン成功後のページにリダイレクト
        } else {
            request.setAttribute("errorMessage", "ユーザーIDまたはパスワードが間違っています。");
            RequestDispatcher dispatcher = request.getRequestDispatcher("Login.jsp");
            dispatcher.forward(request, response);
        }
    }
}

<form action="LoginCon" method="post">
    <div>
        <label for="userId">ユーザーID:</label>
        <input type="text" id="userId" name="userId" required>
    </div>
    <div>
        <label for="password">パスワード:</label>
        <input type="password" id="password" name="password" required>
    </div>
    <button type="submit">ログイン</button>
</form>

package controller;

import java.io.IOException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class Logout extends HttpServlet {
    private static final long serialVersionUID = 1L;

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
        HttpSession session = request.getSession(false); // セッションが存在しない場合はnullを返す
        if (session != null) {
            session.invalidate(); // セッションを無効化
        }
        response.sendRedirect("Login.jsp"); // ログイン画面にリダイレクト
    }
}

<a href="Logout">ログアウト</a>

package filter;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class LoginFilter implements Filter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        HttpSession session = req.getSession(false);
        String loginURI = req.getContextPath() + "/Login.jsp";

        boolean loggedIn = (session != null && session.getAttribute("userId") != null);
        boolean loginRequest = req.getRequestURI().equals(loginURI) || req.getRequestURI().endsWith("/LoginCon");

        if (loggedIn || loginRequest) {
            chain.doFilter(request, response); // 次のフィルターまたはサーブレットへ進む
        } else {
            res.sendRedirect(loginURI); // 未ログインの場合はログイン画面へリダイレクト
        }
    }

    public void init(FilterConfig fConfig) throws ServletException {}
    public void destroy() {}
}

<filter>
    <filter-name>LoginFilter</filter-name>
    <filter-class>filter.LoginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>LoginFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<session-config>
    <session-timeout>30</session-timeout> <!-- 30分 -->
</session-config>