您可以使用Servlet 3.0中引入了HttpServletRequest的API：

You could use the HttpServletRequest API introduced in Servlet 3.0:

    /**
     * Performs authentication via HttpServletRequest API
     */
    public String login(String username, String password) throws IOException {
        try {
            getRequest().login(username, password);
            this.user = userDao.find(username);
        } catch (ServletException e) {
            JsfUtil.addErrorMessage(JsfUtil.getStringResource("loginFailed"));
            return null;
        }
        return "/index?faces-redirect=true";
    }

    public String logout() throws ServletException {
        this.user = null;
        FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
        if (isAuthenticated())
           getRequest().logout();
        return "logout";
    }

    public boolean isAuthenticated() {
        return getRequest().getUserPrincipal() != null;
    }

    public static HttpServletRequest getRequest() {
        Object request = FacesContext.getCurrentInstance().getExternalContext().getRequest();
        return request instanceof HttpServletRequest
                ? (HttpServletRequest) request : null;
    }