Request/Response Cycle

The Request/Response Cycle — and the Bug Almost Everyone Ships Once

HTTP Protocol & Methods covers what a request and a response are structurally. This page is about the cycle — the fact that sending a request is only half the work, and the most common production bugs live in the half developers skip: actually inspecting what came back before acting on it.

/*
 * BEFORE — the request is sent, and the response is trusted blindly.
 * This code "works" in every happy-path demo and manual test.
 */
async function loadUserProfile(userId) {
    const response = await fetch(`/api/users/${userId}`);
    const user = await response.json();   // assumes the body is always valid JSON
    renderProfile(user);
}
// The day the server returns a 500 with an HTML error page (a load balancer's
// default error page, or an unhandled exception rendering Whitelabel Error Page),
// response.json() throws "SyntaxError: Unexpected token '<'". The stack trace
// points at a JSON parser, not at "the request failed" — this is a genuinely
// common production incident that takes longer to diagnose than it should,
// purely because the actual failure (a 500) never got checked for.

/*
 * AFTER — the cycle is closed properly: status is checked before the body
 * is ever touched.
 */
async function loadUserProfile(userId) {
    const response = await fetch(`/api/users/${userId}`);

    if (!response.ok) {   // true only for 2xx — fetch() does NOT reject on 4xx/5xx
        if (response.status === 404) {
            throw new UserNotFoundError(userId);
        }
        throw new Error(`Request failed with status ${response.status}`);
    }

    const user = await response.json();   // only parsed once we KNOW it's the success shape
    renderProfile(user);
}

Anatomy of a Request

// REQUEST LINE — method, path, protocol version
POST /api/orders HTTP/1.1

// HEADERS — metadata about this request
Host: api.example.com
Content-Type: application/json
Content-Length: 61
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Accept: application/json

// BLANK LINE separates headers from body

// BODY — present only for methods that carry a payload
{
    "productId": 42,
    "quantity": 2
}

Anatomy of a Response

// STATUS LINE — protocol, status code, reason phrase
HTTP/1.1 201 Created

// HEADERS
Content-Type: application/json
Location: /api/orders/9001
Date: Thu, 23 Jul 2026 10:30:00 GMT
X-Request-Id: 7e4b1e2a-4f3c-4a1b-9c2d-8f1e2a3b4c5d

// BODY
{
    "id": 9001,
    "productId": 42,
    "quantity": 2,
    "status": "PENDING"
}

The Cycle on the Server: What Spring MVC Actually Saves You From

Raw Servlet — Everything Done by Hand

@WebServlet("/api/users/*")
public class UserServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws IOException {

        // Manual path parsing — no @PathVariable to do this for you
        String pathInfo = request.getPathInfo();          // "/123"
        Long userId = Long.parseLong(pathInfo.substring(1));

        Optional<User> user = userService.findById(userId);
        if (user.isEmpty()) {
            response.setStatus(HttpServletResponse.SC_NOT_FOUND);
            response.setContentType("application/json");
            response.getWriter().write("{\"error\":\"User not found\"}");
            return;
        }

        response.setStatus(HttpServletResponse.SC_OK);
        response.setContentType("application/json");
        response.setCharacterEncoding("UTF-8");
        response.getWriter().write(objectMapper.writeValueAsString(user.get()));
    }
}

Spring MVC — the Same Cycle, the Boilerplate Removed

@RestController
@RequestMapping("/api/users")
public class UserController {

    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @GetMapping("/{id}")
    public ResponseEntity<UserResponse> getUser(@PathVariable Long id) {
        return userService.findById(id)
            .map(UserResponse::fromEntity)
            .map(ResponseEntity::ok)
            .orElseGet(() -> ResponseEntity.notFound().build());
        // Spring parsed the path variable, will serialize the record to JSON,
        // and sets Content-Type automatically. The path parsing bug above —
        // forgetting the leading "/" in substring(1) — simply can't happen here.
    }
}

// A record DTO, never the JPA entity — see client-server.html for why
public record UserResponse(Long id, String name, String email) {
    public static UserResponse fromEntity(User user) {
        return new UserResponse(user.getId(), user.getName(), user.getEmail());
    }
}

The Cycle in the Browser: Fetch API

async function createOrder(orderData, token) {
    const response = await fetch('/api/orders', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'Authorization': `Bearer ${token}`
        },
        body: JSON.stringify(orderData)
    });

    if (!response.ok) {
        const problem = await response.json().catch(() => null);   // body might not even be JSON
        throw new Error(problem?.detail ?? `Request failed: ${response.status}`);
    }

    if (response.status === 201) {
        const location = response.headers.get('Location');
        console.log('Order created at:', location);
    }

    return response.json();
}

What Actually Happens Between "Request Arrives" and "Controller Runs"

Request Arrives
      │
      ▼
┌─────────────────────┐
│  1. FILTER CHAIN     │  Security, CORS, logging — runs for every request, controller or not
└──────────┬───────────┘
           ▼
┌─────────────────────┐
│  2. DISPATCHER       │  Spring's front controller — the single entry point for all MVC requests
│     SERVLET          │
└──────────┬───────────┘
           ▼
┌─────────────────────┐
│  3. HANDLER MAPPING  │  Matches the URL + method to a specific @RequestMapping method
└──────────┬───────────┘
           ▼
┌─────────────────────┐
│  4. INTERCEPTORS     │  preHandle() — auth checks, request timing, before the controller runs
└──────────┬───────────┘
           ▼
┌─────────────────────┐
│  5. CONTROLLER       │  Your method — argument resolution, validation, business logic
└──────────┬───────────┘
           ▼
┌─────────────────────┐
│  6. INTERCEPTORS     │  postHandle() / afterCompletion() — logging, cleanup
└──────────┬───────────┘
           ▼
┌─────────────────────┐
│  7. MESSAGE          │  Jackson serializes the return value to JSON (HttpMessageConverter)
│     CONVERTER        │
└──────────┬───────────┘
           ▼
     Response Sent

Two concrete, real classes that live at steps 1 and 4 — useful the day you need to add cross-cutting behavior instead of repeating it in every controller method:

// Step 1 — a filter: runs for EVERY request, even ones with no matching controller
@Component
public class RequestTimingFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        long start = System.nanoTime();
        try {
            chain.doFilter(request, response);
        } finally {
            long durationMs = (System.nanoTime() - start) / 1_000_000;
            log.info("{} {} -> {} ({} ms)",
                request.getMethod(), request.getRequestURI(), response.getStatus(), durationMs);
        }
    }
}

// Step 4 — an interceptor: only runs for requests that MATCH a controller
@Component
public class AuthCheckInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        if (!isAuthenticated(request)) {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return false;   // short-circuits the chain — the controller is never invoked
        }
        return true;
    }
}

Content Negotiation

The client states what representation it wants via the Accept header; the server picks the best match it can actually produce.

// Client prefers JSON, will accept XML at 90% preference
GET /api/users/123 HTTP/1.1
Accept: application/json, application/xml;q=0.9

@GetMapping(value = "/{id}", produces = { MediaType.APPLICATION_JSON_VALUE, MediaType.APPLICATION_XML_VALUE })
public UserResponse getUser(@PathVariable Long id) {
    return userService.findById(id);   // Spring picks JSON or XML based on the Accept header, automatically
}

Closing the Cycle Correctly: Error Handling

The full ProblemDetail (RFC 9457) pattern is covered in depth in HTTP Protocol & Methods — this is how it plugs into the request/response cycle specifically: exceptions thrown anywhere in step 5 of the pipeline above are intercepted before a response is ever written.

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(UserNotFoundException.class)
    public ProblemDetail handleNotFound(UserNotFoundException ex) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, ex.getMessage());
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ProblemDetail handleValidation(MethodArgumentNotValidException ex) {
        List<String> errors = ex.getBindingResult().getFieldErrors().stream()
            .map(e -> e.getField() + ": " + e.getDefaultMessage())
            .toList();

        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Validation failed");
        problem.setProperty("errors", errors);
        return problem;
    }
}
// @RestControllerAdvice sits OUTSIDE any single controller — it intercepts
// exceptions from every controller, at the exact point in the pipeline
// (step 5→7 above) where the response would otherwise never get built.

When the Cycle Takes a While: Async Processing and Virtual Threads

// Synchronous — the platform thread is blocked for the full duration
@GetMapping("/api/reports/{id}")
public Report getReport(@PathVariable Long id) {
    return reportService.generateReport(id);   // might take 30 seconds of mostly I/O wait
}

// Asynchronous — the platform thread is released while the work runs elsewhere
@GetMapping("/api/reports/{id}")
public CompletableFuture<Report> getReportAsync(@PathVariable Long id) {
    return CompletableFuture.supplyAsync(() -> reportService.generateReport(id));
}

# application.properties — opt in to virtual threads for the whole app
spring.threads.virtual.enabled=true

Debugging a Broken Cycle

# 1. curl -v — see the exact bytes on the wire, request and response
curl -v -X POST http://localhost:8080/api/orders \
  -H "Content-Type: application/json" \
  -d '{"productId": 42, "quantity": 2}'

# 2. Spring's own request/response logging
logging.level.org.springframework.web=DEBUG

# 3. A logging filter with full payload capture — use sparingly, it logs bodies

@Component
public class RequestLoggingFilter extends CommonsRequestLoggingFilter {
    public RequestLoggingFilter() {
        setIncludeQueryString(true);
        setIncludeHeaders(true);
        setIncludePayload(true);
        setMaxPayloadLength(10_000);
    }
}

Best Practices and Common Pitfalls

Interview Questions