Login Problems and General JSP Security Questions

Question

I'm new to this, so I'm still not sure if I'm approaching this problem the right way. But after a user logs in with the correct username/password, I create a session attribute like so:
session.setAttribute("loggedIn", "true");
Now, inside of every other JSP page I make the following check before the user can continue:
<%
          String loggedIn = (String)(session.getAttribute("loggedIn"));
          if( loggedIn == null || !loggedIn.equals("true")) {
%>
               <jsp:forward page="../login.html" />
<%
%>
And to logout I simply set the attribute to false:
session.setAttribute("loggedIn", "false");
Unfortunately, this doesn't work very well. It seems to be very inconsistent. Does anyone know of a better, not-so-difficult, method to do this? Or do you see any problems with what I have?
Another thing, how do I prevent a user from accessing my JSP directory? For example, I have my JSPs stored in public_html/jsp directory, how do I prevent someone from simply visiting www.mysite.com/jsp without using the web.xml file?

Answer 1

I use sessions in this way without any problems, what are the inconsistencies??
You can protect folders with Tomcat security but it requires XML configuration.