Servlets & JSP

What is a Servlet — and Why Does a Spring Developer Need to Know?

A Servlet is a Java class that receives an HTTP request and produces an HTTP response. That's the entire contract — HttpServletRequest in, HttpServletResponse out. The Servlet specification (now jakarta.servlet.*) defines this contract; Tomcat, Jetty, and Undertow are implementations that run servlets inside a Servlet Container.

The reason a Spring developer needs to understand this: Spring MVC's DispatcherServlet is itself a Servlet — it implements HttpServlet and is registered in a Servlet Container exactly like any other servlet. Every HTTP request your Spring Boot application handles goes through this chain:

/*
 *  Browser
 *      │ HTTP request
 *      ▼
 *  Tomcat (Servlet Container)
 *      │ invokes the registered Servlet for this URL
 *      ▼
 *  DispatcherServlet  ←  this IS a Servlet (extends HttpServlet)
 *      │ Spring's own routing logic
 *      ▼
 *  @RestController / @Controller method
 *      │ your code
 *      ▼
 *  HTTP response back to browser
 *
 * Understanding Servlets = understanding what's running underneath Spring.
 */

The Servlet Lifecycle

/*
 *  Container startup
 *      │
 *      ▼
 *  new HelloServlet()          ← container calls the no-arg constructor
 *      │
 *      ▼
 *  init(ServletConfig config)  ← called ONCE, before any request is handled
 *      │                          override to set up resources (DB connections, etc.)
 *      ▼
 *  ┌──────────────────────────────────────────────┐
 *  │  For each incoming request (concurrent):      │
 *  │                                              │
 *  │  service(request, response)                   │
 *  │      ├── doGet()    ← GET requests            │
 *  │      ├── doPost()   ← POST requests           │
 *  │      ├── doPut()    ← PUT requests            │
 *  │      ├── doDelete() ← DELETE requests         │
 *  │      └── ...                                  │
 *  └──────────────────────────────────────────────┘
 *      │
 *      ▼
 *  destroy()                   ← called ONCE when container shuts down
 *                                 override to release resources
 */

import jakarta.servlet.*;
import jakarta.servlet.http.*;
import jakarta.servlet.annotation.*;
import java.io.*;

@WebServlet("/hello")
public class HelloServlet extends HttpServlet {

    // ✅ Safe: set once in init(), never changed — effectively final
    private String greeting;

    // ❌ WRONG: mutable instance variable — race condition under concurrent requests
    // private int requestCount = 0;

    @Override
    public void init() {
        greeting = getServletConfig().getInitParameter("greeting");  // read-only after init
    }

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        String name = request.getParameter("name");  // ✅ Safe: local variable, per-request

        response.setContentType("text/plain;charset=UTF-8");
        response.getWriter().println(greeting + ", " + name);
    }

    @Override
    public void destroy() {
        // release any resources opened in init()
    }
}

HttpServletRequest and HttpServletResponse

@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {

    // ── Reading the request ───────────────────────────────────────────────
    String name   = request.getParameter("name");        // query param or form field
    String auth   = request.getHeader("Authorization");  // request header
    String method = request.getMethod();                  // "GET", "POST", etc.
    String uri    = request.getRequestURI();              // "/myapp/users"
    String body   = request.getReader().lines()           // raw body as string
        .collect(java.util.stream.Collectors.joining());

    // Attributes (server-side data attached to THIS request, not from client)
    request.setAttribute("user", currentUser);
    Object user = request.getAttribute("user");

    // ── Building the response ─────────────────────────────────────────────
    response.setStatus(HttpServletResponse.SC_CREATED);         // 201
    response.setContentType("application/json;charset=UTF-8");
    response.setHeader("Location", "/api/users/123");

    response.getWriter().println("{\"id\":123,\"name\":\"" + name + "\"}");

    // Forward vs Redirect — different things, different use cases
    request.getRequestDispatcher("/WEB-INF/views/success.jsp")
           .forward(request, response);   // server-side: same request, same URL in browser

    response.sendRedirect("/dashboard");  // client-side: new GET request, URL changes
}

Filters — Cross-Cutting Concerns Before the Servlet

A Filter intercepts requests before they reach any servlet — and responses on the way back out. The filter chain runs in declared order; each filter calls chain.doFilter() to pass control to the next filter or the servlet, or it can short-circuit by writing directly to the response without calling chain.doFilter().

@WebFilter("/*")  // applies to every URL
public class RequestLoggingFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res,
                          FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest httpReq = (HttpServletRequest) req;
        long start = System.currentTimeMillis();

        chain.doFilter(req, res);   // ← hand off to the next filter or the servlet

        long elapsed = System.currentTimeMillis() - start;
        log.info("{} {} → {}ms", httpReq.getMethod(), httpReq.getRequestURI(), elapsed);
    }
}

// Auth filter — short-circuits if token is missing, never calls chain.doFilter()
@WebFilter("/api/*")
public class AuthFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res,
                          FilterChain chain)
            throws IOException, ServletException {

        String auth = ((HttpServletRequest) req).getHeader("Authorization");
        if (auth == null || !auth.startsWith("Bearer ")) {
            ((HttpServletResponse) res).sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return;  // short-circuit — servlet never runs
        }
        chain.doFilter(req, res);
    }
}

JSP — Historical Context, Not a Recommendation

JSP (JavaServer Pages) allowed embedding Java code directly inside HTML, so the server could render dynamic content without routing through a servlet for every page. It was the dominant server-side rendering technology in Java from the late 1990s through the mid-2000s.

<!-- users.jsp — a realistic example showing WHY JSP fell out of favour -->
<%@ page import="java.util.List" %>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>

<html><body>
<h1>Users</h1>

<%-- Scriptlet (avoid) — mixes Java and HTML, untestable, unmaintainable --%>
<%
    List users = (List) request.getAttribute("users");
    for (Object u : users) {
        out.println("<p>" + u + "</p>");  // XSS risk: no escaping
    }
%>

<%-- JSTL (the "clean" JSP way) — still JSP, but at least no scriptlets --%>
<c:forEach var="user" items="${users}">
    <p><c:out value="${user.name}"/></p>  <%-- c:out escapes HTML --%>
</c:forEach>

</body></html>

The MVC Pattern with Servlets + JSP

/*
 * Classic Servlet + JSP MVC — the pattern that Spring MVC formalized:
 *
 *  Browser → GET /users
 *                │
 *                ▼
 *  UserListServlet.doGet()          ← Controller: fetch data, put in request scope
 *      userService.findAll()
 *      request.setAttribute("users", users)
 *      request.getRequestDispatcher("/WEB-INF/views/users.jsp").forward(req, res)
 *                │
 *                ▼
 *  users.jsp                        ← View: render the data, no business logic
 *      ${users} — display the list
 *
 * Spring MVC is exactly this pattern, with DispatcherServlet as the single
 * front controller instead of one servlet per URL, and Thymeleaf instead of JSP.
 */

@WebServlet("/users")
public class UserListServlet extends HttpServlet {

    private UserService userService;  // can't @Inject here without CDI — see CDI page

    @Override
    public void init() {
        userService = new UserService();  // manual wiring without a DI container
    }

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse res)
            throws ServletException, IOException {
        req.setAttribute("users", userService.findAll());
        req.getRequestDispatcher("/WEB-INF/views/users.jsp").forward(req, res);
    }
}

Session Management

HTTP is stateless — each request carries no memory of previous ones. The Servlet API's HttpSession is the container-managed mechanism for maintaining state across requests for the same user, backed by a session ID stored in a cookie (JSESSIONID by default).

@Override
protected void doPost(HttpServletRequest req, HttpServletResponse res)
        throws ServletException, IOException {

    if (authenticate(req.getParameter("username"), req.getParameter("password"))) {
        // getSession(true) = create if absent; getSession(false) = return null if absent
        HttpSession session = req.getSession(true);
        session.setAttribute("username", req.getParameter("username"));
        session.setMaxInactiveInterval(30 * 60);  // 30 minutes; -1 = never expire
        res.sendRedirect("/dashboard");           // PRG pattern — prevents form resubmission
    } else {
        res.sendRedirect("/login?error=invalid");
    }
}

// Logout — always invalidate, never just remove attributes
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse res)
        throws ServletException, IOException {

    HttpSession session = req.getSession(false);  // false = don't create if absent
    if (session != null) {
        session.invalidate();  // destroys the session — all attributes gone, ID invalidated
    }
    res.sendRedirect("/login");
}

WebSocket — Bidirectional Communication from the Servlet Container

The WebSocket spec (jakarta.websocket.*) is part of the same Servlet container infrastructure. A WebSocket endpoint is deployed alongside servlets in the same WAR and managed by the same container — which is why it belongs in this section rather than a separate page.

import jakarta.websocket.*;
import jakarta.websocket.server.ServerEndpoint;

@ServerEndpoint("/ws/chat")  // URL: ws://host/app/ws/chat
public class ChatEndpoint {

    @OnOpen
    public void onOpen(Session session) {
        log.info("Client connected: {}", session.getId());
    }

    @OnMessage
    public void onMessage(String message, Session session)
            throws IOException {
        // Echo back to the same client
        session.getBasicRemote().sendText("Echo: " + message);
    }

    @OnError
    public void onError(Throwable error, Session session) {
        log.error("WebSocket error on session {}", session.getId(), error);
    }

    @OnClose
    public void onClose(Session session, CloseReason reason) {
        log.info("Connection closed: {} — {}", session.getId(), reason.getReasonPhrase());
    }
}

Interview Questions