Spring Web/MVC

Spring MVC is a web framework in Spring for building HTTP web apps and REST APIs using the Model-View-Controller pattern.

Model, View, Controller.

Handle incoming HTTP requests and return responses (view or data).

Holds data passed between controller and view/business layers.

Renders UI output (HTML/templates) in server-side rendered applications.

Front controller that routes requests to handlers and coordinates MVC workflow.

It centralizes request handling and framework integration points.

Maps incoming request to a controller method.

Invokes the matched handler method with resolved arguments.

Resolves logical view names to actual template/view implementations.

Marks a class as Spring MVC controller (typically view-oriented).

Convenience annotation combining @Controller + @ResponseBody for REST APIs.

Maps HTTP paths/methods/content conditions to controller classes/methods.

@GetMapping, @PostMapping, @PutMapping, @DeleteMapping, @PatchMapping.

Binds URI path segment value to method parameter.

Binds query string/form parameter to method parameter.

Binds HTTP request payload to Java object.

Writes method return value directly to HTTP response body.

Represents full HTTP response with status, headers, body.

Choosing response format (e.g., JSON/XML) based on headers and config.

Accept header.

Content-Type header.

Converts request/response body between bytes and Java objects.

Jackson-based converter (typically).

200 OK.

201 Created.

204 No Content.

400 Bad Request.

401 Unauthorized.

403 Forbidden.

404 Not Found.

500 Internal Server Error.

Sets HTTP status on controller method or exception type.

Binds HTTP header value to method parameter.

Binds cookie value to method parameter.

Binds request parameters to model object (often for forms).

Holds binding/validation errors for model attributes/request bodies.

Using constraints annotations and @Valid / @Validated with MVC binding.

@Validated supports validation groups in Spring.

Customizes data binding/validators for controller scope.

Converting String request input into target Java types.

Locale-aware parser/printer for presentation-layer type conversion.

General type conversion abstraction.

Cross-Origin Resource Sharing rules for browser cross-origin requests.

Globally via configurer or per-controller/per-method annotations.

Annotation enabling/configuring CORS for endpoints.

Post/Redirect/Get pattern to prevent duplicate form submissions.

Temporary attribute surviving redirect for one subsequent request.

Returning redirect:/path triggers client redirect.

forward:/path forwards request internally on server.

Spring auto-resolves known parameter types/annotations via resolvers.

Yes, especially in REST; converter serializes them.

Yes, but keep design boundaries clear.

Serving CSS/JS/images from configured resource locations.

Determining user locale for messages/formatting.

Resolves i18n messages from bundles.

Putting business logic directly in controllers.

Service layer, not controller methods.

Clear resource naming, proper status codes, validated inputs.

Keep controllers thin, responses explicit, and validation consistent.

MVC component for pre/post processing around handler invocation.

Filter is servlet-container level; interceptor is Spring MVC handler level.

Auth context setup, request logging, correlation IDs, timing.

preHandle, postHandle, afterCompletion.

Cleanup resources/context even when exceptions occur.

Global component for exception handling, binder/model enhancements.

@ControllerAdvice + @ResponseBody for REST-centric global handling.

Method-level/global handler for specific exception types.

Consistency of error payloads and reduced duplication.

Programmatic exception carrying HTTP status and reason.

Standardized JSON structure for API errors.

Predictable client integration and easier troubleshooting.

Splitting large collections into pages with limit/offset or cursor parameters.

Performance, bandwidth control, and client usability.

Accepting sort fields/directions as query params with validation.

Including navigational links in representations to guide clients.

Not always; depends on domain/client needs.

Response validator for caching/conditional requests.

Client sends ETag; server returns 304 if unchanged.

Timestamp-based conditional request support.

Response indicating cached client resource is still valid.

Repeated identical request yields same intended effect (e.g., PUT/DELETE semantics).

No.

Use idempotency keys and dedup logic.

Mass assignment/binding to unintended fields.

Use DTOs and explicit allowed fields.

Decouple API contracts from domain entities and control exposure.

Entities are persistence models; DTOs are transport contracts.

Different constraints for create vs update operations.

User-defined validation logic beyond built-in constraints.

Raised when @Valid request body binding fails.

Extract errors from BindingResult/exception and map to structured response.

Occurs when request value cannot convert to expected type.

Global exception handling with clear client error messages.

Handling file uploads/form-data in controllers.

Spring abstraction representing uploaded file.

Size limits, content-type checks, virus scanning, storage isolation.

Free servlet thread while background processing continues.

Callable, DeferredResult, WebAsyncTask.

Improve scalability for long-running I/O operations in servlet stack.

Define timeout + fallback/error response behavior.

Streaming server updates over HTTP to clients.

Access request headers/body as typed entity wrappers.

Hook to customize/transform response bodies globally.

Hook to inspect/modify request body before controller method consumes it.

Extension to resolve custom parameter types in controller methods.

Inject current authenticated domain user object.

Binds web request params to Java objects with conversion/validation.

Ant-style vs PathPattern parser differences affect route behavior/performance.

Ambiguity causes startup failures or unpredictable routing.

URI/header/media-type versioning approaches for evolving APIs.

Preserve backward compatibility for existing clients.

Communicate sunset timelines and migration guidance.

Interceptor switching locale based on request parameter/header.

Resolves UI theme resources for server-rendered apps.

Thymeleaf/JSP/Freemarker template rendering in MVC.

Redirect changes URL/new request; forward stays internal same request.

Store conversational state across requests (use sparingly).

Scalability, memory, and stateless API concerns.

Fat controllers handling validation, business rules, and persistence together.

Thin controllers + service orchestration + unified error contract.

Improves client integration and reduces support cost.

Machine-readable API spec for docs/client generation/testing.

Design API spec first vs derive spec from implemented code.

Consistent status codes, validation errors, and observable request flow.

Unexpected converter selection causing incompatible payload formats.

Order/customize HttpMessageConverters and media type support explicitly.

Use streaming responses/resources to avoid loading full payload in memory.

Efficient file transfer using server/container optimizations where possible.

Blocking model lacks native reactive backpressure; must control concurrency/timeouts.

Write timeouts, response buffering strategy, connection limits.

All request threads busy, causing queueing/timeouts.

Optimize handlers, offload slow I/O, tune pools/timeouts, apply bulkheads.

Isolate critical endpoints/resources from noisy neighbors.

Limit request frequency per client/key to protect service availability.

Gateway, filter/interceptor, or dedicated infrastructure layer.

Need fast consistent dedup store with TTL and conflict handling.

Use version/ETag with conditional updates (If-Match).

Conditional request failed due to version/ETag mismatch.

Gateway handles cross-cutting edge concerns; MVC handles domain endpoint logic.

Backend-for-Frontend tailored endpoints for specific client experiences.

Translate external payload semantics to internal domain model safely.

Prevents tight coupling, data leaks, and evolution constraints.

Input validation, authz checks, CSRF/CORS policy, headers, output encoding.

Method security protects service methods; URL security protects request routes.

Defense in depth and clearer enforcement boundaries.

User-controlled URLs triggering unsafe server-side outbound requests.

Allowlists, DNS/IP validation, network egress controls.

Malformed HTTP parsing discrepancies across proxies/servers.

Edge proxies/load balancers + strict server config.

Structured logs, request metrics, traces, and correlation IDs.

RPS, latency percentiles, error rates, saturation, payload sizes.

Tail latency captures worst user impact and hidden bottlenecks.

Unbounded labels (e.g., raw user IDs) exploding metrics storage.

Use bounded dimensions like route template and status class.

Fallback responses/partial data when downstream dependencies fail.

Prevent repeated slow/failing downstream calls from exhausting resources.

Define per-hop timeouts so end-to-end SLA is protected.

Avoid hanging threads and unpredictable client experience.

Additive changes first; deprecate/remove fields with clear versioning policy.

Automated tests ensuring old clients still work after changes.

Consumers define expectations verified against provider builds.

Roll out endpoint changes to small traffic subset before full release.

Replay production-like traffic to new version without impacting users.

Map technical failures to stable client-facing error categories.

Correlate logs, traces, metrics, deploy diffs, and dependency health.

Treating controllers as orchestration engines with hidden domain logic.

Small cohesive endpoints with delegated business operations.

Versioning, deprecation policy, review standards, and observability gates.

Always-current OpenAPI, examples, error catalog, and auth guidance.

Backward-compatible contracts during rolling/blue-green updates.

Schema diff checks, contract tests, staged rollout, telemetry-based verification.

Optimize end-to-end path: serialization, DB calls, downstream I/O, and thread usage.

Keep web layer focused on transport concerns; isolate domain logic in services.

Design APIs for clarity, compatibility, observability, and operational resilience.