In Java EE form-based authentication, the login form must POST to j_security_check. This is a built-in servlet container endpoint that receives j_username and j_username parameters, authenticates the user against the realm, and redirects to the protected resource or error page. The other options (j_login, j_get_user, j_login_check, j_get_security) are not standard container-managed authentication endpoints.