Hand 0 Newbie Poster

Hello, I want to know how to implement an authentication system.

I know how to use HttpSession, but how will I ensure that an user cannot create false cookies to access protected area?

Is it safe to keep the password as a session attribute?