Hello, I want to know how to implement an authentication system.
I know how to use HttpSession, but how will I ensure that an user cannot create false cookies to access protected area?
Is it safe to keep the password as a session attribute?
