servlet登录验证

public class LoginServlet extends HttpServlet{
    DbUtil dbUtil=new DbUtil();
    UserDao userDao=new UserDao();
    
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        this.doPost(request, response);
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String userName=request.getParameter("userName");
        String password=request.getParameter("password");
        request.setAttribute("userName", userName);
        request.setAttribute("password", password);
        if(StringUtil.isEmpty(userName)||StringUtil.isEmpty(password)){
            request.setAttribute("error", "用户名和密码错误");
            request.getRequestDispatcher("index.jsp").forward(request, response);
            return;
        }
        User user=new User(userName,password);
        Connection con=null;
        try {
            con=dbUtil.getCon();
            User currentUser=userDao.login(con, user);
            if(currentUser==null){
                request.setAttribute("error", "用户名");
                // 服务端跳转
                request.getRequestDispatcher("index.jsp").forward(request, response);
            }else{
                // 获取Session，可用于权限验证
                HttpSession session=request.getSession();
                session.setAttribute("currentUser", currentUser);
               //客户端跳转
                response.sendRedirect("main.jsp");
            }
        } catch (Exception e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }finally{
            try {
                dbUtil.closeCon(con);
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        } 
    }  
}