I told you to move check logic into separate method, not the whole logic. Now you can have NPE due to absence of session.

This is what I've been struggling to achieve:
```java
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws java.io.IOException, ServletException {
    if (isAuthenticated(request)) {        
        chain.doFilter(request, response);
    } else {
        Util.forward(request, response, "/auth/loginPage.jsp");
    }
}

private boolean isAuthenticated(ServletRequest request) throws java.io.IOException, ServletException {
    if (request instanceof HttpServletRequest) {
        HttpSession session = ((HttpServletRequest) request).getSession();
        if (session != null) {
            User user = (User) session.getAttribute(SESSION_ATTR_AUTH_USER); 
            if (user != null) {
                return true;
            }
        }
    }

    return false;
}
```