spark-session.java

get("/login", (req, res) -> {
	// create route  that render a login screen
});

get("/logout", (req, res) -> {
	// or see how to destroy the session
	request.session().removeAttribute("username"); // Remove session attribute 'user'
	res.redirect("/login");
});

post("/login", (req, res) -> {
	// post to this route from your login html form
	// validate your username & password

	//start a new session
	session = request.session(true);
	// put the username in the session
	request.session().attribute("username", username);

	// if it is valid redirect to the "/" or "/home" route
	// otherwise redirect to "/login"
});


// add a 

before((request, response) -> {
	boolean authenticated;
	
	// check if this is the /login route - if it is 
	if (!request.uri().equals("login")) {
		if (request.session().attribute("username") != null) {
			authenticated = true;
		}
	
		// ... check if authenticated
		if (!authenticated) {
			response.redirect("/login");
		} else {
			response.redirec("/");
		}
	}
	
});