Form-Based Authentication

You can instruct the servlet server to use a form, but still do the same basic authentication.
Friendly logins. Very popular.

Change web.xml to

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN"
    "http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">
<web-app>
  <!-- ...--->

    <login-config>
        <auth-method>
            FORM       <!-- BASIC, DIGEST, FORM, CLIENT-CERT -->
        </auth-method>                                               
      <form-login-config>
         <form-login-page>
            /loginpage.html
         </form-login-page>
         <form-error-page>
            /errorpage.html
         </form-error-page>
      </form-login-config>
    </login-config>

no the server will show loginpage.html whenever someone who has not logged in tries to access a secure page. loginpage.html should look something like

<!--The j_* names are important-->
<form method="POST" action="j_security_check">
Name: <input type="text" name="j_username" value="" size="15">
Password: <input type="password" name="j_password" value="" size="15">
<input type="submit" value="  OK   "> 
</form>

Password is transmitted in plain text.
Neither form or standard support logout.