jsf 2 - How to auto login by a cookie with JSF/EJB/JBoss -

i'm using jboss 7.1.1, jsf2.0, ejb 3.1.

i'm trying auto login user when re-visiting. (not full login, @ least give him customized views - never let him/her invoke financial transaction based on cookie identification).

so, thought it's easy grab jsf phase listener, check set cookie (containing uuid) , auto login user. noticed, not inject beans.

hm. ok. how else establish auto login? must @ place every request goes thru - no mather of uri requested.

so, initial approach code below - not working of course, since injected objects set null.

1) idea how accomplish this?
2) looks costly computation (thinking of every request going thruw phase listener). smarter way imposes?

public class reloginphaselistener implements phaselistener {  private static final long serialversionuid = 3690040902641689160l; @inject private logger log;  @inject private facescontext ctx;  @inject  beanmanager beanmgr;  /**  * existing logincontroller (as managed property since it's managed  * bean.)  */ @managedproperty(value = "#{logincontroller}") private logincontroller logincontroller;  /*  * cannot inject ejb here, because it's not managed jsf engine.  * @inject userrepository userrepository;  */ @override public void afterphase(phaseevent event) {     // no need implement }  @override public void beforephase(phaseevent event) {     // check if in session????     facescontext ctx = event.getfacescontext();     map<string, object> cookies = ctx.getexternalcontext().getrequestcookiemap();     cookie rmcookie = (cookie) cookies.get("ccode");     cookie usercookie = (cookie) cookies.get("userid");     // go further if ccode exists     if (rmcookie != null && usercookie != null) {         map<string, object> sessionmap = ctx.getexternalcontext().getsessionmap();         user currentuser = (user) sessionmap.get("user");         if (currentuser != null) {             string rmkey = currentuser.getremembermekey();             // if remember key exists, check if corresponds             // cookie code.             if (rmkey != null && !rmkey.isempty()) {              }         } else {             // read database if there's user id ,             // ccode.             userrepository userrep = getuserrepfacade();             user user = userrep.findbyid(long.parselong(usercookie.getvalue()));             if (user.getremembermekey().equals(rmcookie.getvalue()))                 logincontroller.setuser(user);         }     }     // request object , check if cookie available. if corresponds     // database, restricted-log in. }  @override public phaseid getphaseid() {     // todo auto-generated method stub     return phaseid.restore_view; }  public userrepository getuserrepfacade() {           bean<userrepository> bean = (bean<userrepository>) beanmgr.getbeans(userrepository.class)             .iterator().next();     creationalcontext<userrepository> ctx = beanmgr.createcreationalcontext(bean);     userrepository userrep = (userrepository) beanmgr.getreference(bean, userrepository.class, ctx);     // inlined, intentionally left way     return userrep; } 

}

to make solution more secured, encrypt cookie using aes-256. (you can put parameters in same cookie). prevent brute force attacks on applications: not allow attacker guess usernames. in case open other page , let know attacker username.