This week's book giveaways are in the Refactoring and Agile forums. We're giving away four copies each of Re-engineering Legacy Software and Docker in Action and have the authors on-line! See this thread and this one for details.
In JSP you don't have to use request.getSession() but session. If you always get attribute null, maybe user is always null or the session is invalidated at some point. You can check with session.isNew().