java - NPE on a session filter -

i trying check cookies on pages in filter. code follows:

public class sessionfilter implements filter {   private arraylist<string> urllist;  @override public void destroy() { // todo auto-generated method stub  }  @override public void dofilter(servletrequest req, servletresponse resp, filterchain chain)   throws ioexception, servletexception { httpservletrequest request = (httpservletrequest) req; httpservletresponse response = (httpservletresponse) resp; string url = request.getservletpath(); boolean allowedrequest = false;  if (urllist.contains(url)) {   allowedrequest = true; }  string username = null; string password = null; string loggedin = null;  if (!allowedrequest) {   cookie[] cookies = request.getcookies();    (int = 0; < cookies.length; i++) {     string name = cookies[i].getname();     string value = cookies[i].getvalue();      if (name.equals("bccn_username"))       username = value;     else if (name.equals("bccn_password"))       password = value;     else if (name.equals("bccn_loggedin"))       loggedin = value;   }    if (loggedin.equals("true")) {     if (username != null && password != null) {       checklogin obj = new checklogin();       string ret = obj.check(username, password);       if (ret.equals("logged in")) {        } else {         response.sendredirect("login.jsp");       }     } else {       response.sendredirect("login.jsp");     }   } else {     response.sendredirect("login.jsp");   }  } else {   response.sendredirect("login.jsp"); }  chain.dofilter(req, resp);  }  @override public void init(filterconfig config) throws servletexception { string urls = config.getinitparameter("avoid-urls"); stringtokenizer token = new stringtokenizer(urls, ",");  urllist = new arraylist<string>();  while (token.hasmoretokens()) {   urllist.add(token.nexttoken());  }  }  } 

and in web.xml

  <filter> <filter-name>sessionfilter</filter-name> <filter-class>     ws.abhis.sessionfilter </filter-class> <init-param>     <param-name>avoid-urls</param-name>     <param-value>index.html</param-value>     <param-value>login.jsp</param-value>     <param-value>styles.css</param-value> </init-param> </filter> <filter-mapping>   <filter-name>sessionfilter</filter-name>   <url-pattern>/*</url-pattern> </filter-mapping> 

however, getting error on application load:

java.lang.nullpointerexception     ws.abhis.sessionfilter.dofilter(unknown source) 

i noob @ appreciated.

tia.

your urllist variable seems uninitialized , doing operation on this:

if (urllist.contains(url))  

will cause null pointer exception.

make sure initialize list before using it.