I have a web application that logs users in a @SessionScoped managed bean. It's all the basic stuff, pretty much like this: users logs in using regular http form and gets redirect to user area (wich is protected using a filter). But if any resource on that area is accessed, the request somehow uses a new session, wich has no managed bean, no user, and the filter does his job, redirecting him to login page.

Here's the login form:

<h:form>
    <h:outputLabel for="email" value="Email "/>
    <p:inputText id="email" size="30" value="#{loginManager.email}"/>
    <h:outputLabel for="password" value="Password "/>
    <p:password id="password" size="12" value="#{loginManager.password}"/>
    <p:commandButton value="Login" action="#{loginManager.login()}"/>
</h:form>

The loginManager managed bean:

@ManagedBean
@SessionScoped
public class LoginManager implements Serializable {
    @EJB private UserService userService;
    private User user;
    private String email;
    private String password;

    public String login() {
        user = userService.findBy(email, password);
        if (user == null) {
            // FacesMessage stuff
        } else {
            return "/user/welcome.xhtml?faces-redirect=true";
        }
    }

    public String logout() {
        FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
        return "/index.xhtml?faces-redirect=true";
    }

    // Getters, setters (no setter for user) and serialVersionUID 

And then comes the filter that protects the user area:

@WebFilter(urlPatterns="/user/*", displayName="UserFilter")
public class UserFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
            FilterChain chain) throws IOException, ServletException {
        HttpSession session = ((HttpServletRequest)request).getSession(false);
        LoginManager loginManager = 
                (LoginManager) session.getAttribute("loginManager");
        if (loginManager == null || !loginManager.hasUser()) {
            HttpServletResponse resp = (HttpServletResponse) response;
            resp.sendRedirect("index.xhtml");
        }
        final User user = loginManager.getUser();
        if (user.isValid()) {
            chain.doFilter(request, response);
        } else {
            HttpServletResponse resp = (HttpServletResponse) response;
            resp.sendRedirect("index.xhtml");
        }
    }

The UserService is just a stateless EJB that handles persistence. Part of the JSF for user area:

<h:form>
    <p:panelMenu>
        <p:submenu label="Items">
            <p:menuitem value="Add item" action="#{userItens.addItems}" ajax="false"/>
            <p:menuitem value="My items" />
        </p:submenu>
    </p:panelMenu>
</h:form>

And finally the userItens managed bean.

@ManagedBean
@RequestScoped
public class UserItens {   
    private User user;

    @PostConstruct
    private void init() {
        HttpSession session = (HttpSession) FacesContext.getCurrentInstance()
                .getExternalContext().getSession(false);
        LoginManager loginManager = 
                (LoginManager) session.getAttribute("loginManager");
        if (loginManager != null)
            user = loginManager.getUser();
    }

    public String addItems() {
        // Doesn't get here. Seems like UserFilter comes first, doesn't find 
        // an user and redirects.

    }

I'm using glassfish and session timeout is now on 0.