@MisuriWijewardhana just to understand, you have both those pieces of code (the one that outputs the html and the one that sets the attrbutes etc.) in that specific order? Because if that's the case you should move
User auth =(User) request.getSession().getAttribute("auth"); before any use of the auth variable (so before the first piece of code).