This week's book giveaway is in the OCAJP 8 forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide and have Edward Finegan & Robert Liguori on-line! See this thread for details.
In JSP you don't have to use request.getSession() but session. If you always get attribute null, maybe user is always null or the session is invalidated at some point. You can check with session.isNew().