@Named
@RequestScoped
public class SigninController implements Serializable {
private static final long serialVersionUID = 1L;

private String username;
private String password;
@EJB
private SigninBeanLocal signinBeanLocal;

public String login() {
    User user =  signinBeanLocal.find(username, password);

    FacesContext context = FacesContext.getCurrentInstance();

    if (user == null) {
        context.addMessage("signinForm", new FacesMessage("Unknown login, try again"));
        username = null;
        password = null;
        return null;
    } else {
        context.getExternalContext().getSessionMap().put("user", user);
        return "index?faces-redirect=true";
    }
}
...

@WebFilter(urlPatterns={"/index.jsf"})
public class LoginFilter implements Filter{


@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws ServletException, IOException {

    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession(false);
    String loginURI = request.getContextPath() + "/signin.jsf";

    boolean loggedIn = session != null && session.getAttribute("user") != null;
    boolean resourceRequest = request.getRequestURI().startsWith(request.getContextPath() + ResourceHandler.RESOURCE_IDENTIFIER);

    if (loggedIn || resourceRequest) {
        chain.doFilter(request, response);
    } else {
        response.sendRedirect(loginURI);
    }
}
}