Try to stepover getUser(HttpServletRequest request, HttpServletResponse response) Also, if user is not resolved by session, why not to try resolve it from cookie