Then both the authchecker servlet as well as the page rendering need to do the same: Check this cookie. The authchecker returns a non-200 status code and the page rendering will return also a non-200 status code.While on the authchecker this can be easy implemented, but for the check before the page rendering you need more complex logic. I would write a request filter and check the cookie if these page(s) are requested.