Spring MVC Request Lifecycle

// Simplified — this is what happens inside the container
public void doFilter(ServletRequest request, ServletResponse response,
                     FilterChain chain) throws IOException, ServletException {

    // --- Your pre-processing ---
    long startTime = System.nanoTime();

    // Pass to next filter (or DispatcherServlet if last in chain)
    chain.doFilter(request, response);

    // --- Your post-processing (response is now committed) ---
    long duration = TimeUnit.NANOSECONDS.toMillis(System.nanoTime() - startTime);
    log.info("Request took {}ms", duration);
}

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CorrelationIdFilter extends OncePerRequestFilter {

    private static final String CORRELATION_HEADER = "X-Correlation-ID";

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {

        String correlationId = request.getHeader(CORRELATION_HEADER);
        if (correlationId == null) {
            correlationId = UUID.randomUUID().toString();
        }

        // Add to MDC for logging
        MDC.put("correlationId", correlationId);
        // Add to response so client can reference it
        response.setHeader(CORRELATION_HEADER, correlationId);

        try {
            filterChain.doFilter(request, response);
        } finally {
            MDC.remove("correlationId");  // CRITICAL: clean up ThreadLocal
        }
    }
}

protected void doDispatch(HttpServletRequest request,
                          HttpServletResponse response) throws Exception {
    HandlerExecutionChain mappedHandler = null;
    ModelAndView mv = null;
    Exception dispatchException = null;

    try {
        // STEP 1: Check if multipart (file upload)
        request = checkMultipart(request);

        // STEP 2: Find the handler (controller method) for this request
        mappedHandler = getHandler(request);
        if (mappedHandler == null) {
            noHandlerFound(request, response);  // → 404
            return;
        }

        // STEP 3: Find the adapter that knows how to invoke this handler type
        HandlerAdapter ha = getHandlerAdapter(mappedHandler.getHandler());

        // STEP 4: Run interceptor preHandle() methods
        if (!mappedHandler.applyPreHandle(request, response)) {
            return;  // An interceptor said "stop" — request ends here
        }

        // STEP 5: Actually invoke the controller method
        mv = ha.handle(request, response, mappedHandler.getHandler());

        // STEP 6: Run interceptor postHandle() methods
        mappedHandler.applyPostHandle(request, response, mv);

    } catch (Exception ex) {
        dispatchException = ex;
    }

    // STEP 7: Process result — render view or handle exception
    processDispatchResult(request, response, mappedHandler, mv, dispatchException);
}

protected void initStrategies(ApplicationContext context) {
    initMultipartResolver(context);       // File upload handling
    initLocaleResolver(context);          // i18n
    initThemeResolver(context);           // Theming (deprecated in Spring 6)
    initHandlerMappings(context);         // URL → Controller resolution
    initHandlerAdapters(context);         // Controller invocation
    initHandlerExceptionResolvers(context); // Error handling
    initRequestToViewNameTranslator(context);
    initViewResolvers(context);           // View name → HTML
    initFlashMapManager(context);         // Redirect attributes
}

// What the registry looks like internally (simplified)
Map<RequestMappingInfo, HandlerMethod> registry = {
    {GET /api/orders/{id}}      → OrderController.getOrder(Long),
    {GET /api/orders}           → OrderController.listOrders(Pageable),
    {POST /api/orders}          → OrderController.createOrder(OrderRequest),
    {PUT /api/orders/{id}}      → OrderController.updateOrder(Long, OrderRequest),
    {DELETE /api/orders/{id}}   → OrderController.deleteOrder(Long)
}

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    // Matches: GET /api/orders/42
    @GetMapping("/{id}")
    public Order getOrder(@PathVariable Long id) { ... }

    // Matches: GET /api/orders?status=PENDING
    @GetMapping(params = "status")
    public List<Order> getByStatus(@RequestParam OrderStatus status) { ... }

    // Matches: POST /api/orders with Content-Type: application/json
    @PostMapping(consumes = MediaType.APPLICATION_JSON_VALUE)
    public Order createOrder(@RequestBody CreateOrderRequest request) { ... }

    // Matches: GET /api/orders with Accept: text/csv
    @GetMapping(produces = "text/csv")
    public String exportOrders() { ... }
}

public interface HandlerInterceptor {

    // BEFORE controller. Return false = request stops here.
    // The 'handler' parameter IS the controller method — you can inspect annotations.
    default boolean preHandle(HttpServletRequest request,
                              HttpServletResponse response,
                              Object handler) throws Exception {
        return true;
    }

    // AFTER controller, BEFORE view rendering.
    // NOT called if controller threw an exception.
    // NOT called if preHandle returned false.
    default void postHandle(HttpServletRequest request,
                            HttpServletResponse response,
                            Object handler,
                            @Nullable ModelAndView modelAndView) throws Exception {
    }

    // ALWAYS runs — even if exception occurred. Like a finally block.
    // Use for: resource cleanup, ThreadLocal removal, metrics recording.
    default void afterCompletion(HttpServletRequest request,
                                 HttpServletResponse response,
                                 Object handler,
                                 @Nullable Exception ex) throws Exception {
    }
}

@Component
public class RateLimitInterceptor implements HandlerInterceptor {

    private final RateLimiterService rateLimiter;

    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response,
                             Object handler) throws Exception {

        // Only rate-limit annotated endpoints
        if (handler instanceof HandlerMethod handlerMethod) {
            RateLimit annotation = handlerMethod.getMethodAnnotation(RateLimit.class);
            if (annotation != null) {
                String clientId = request.getHeader("X-Client-ID");
                if (!rateLimiter.tryAcquire(clientId, annotation.value())) {
                    response.setStatus(429);
                    response.getWriter().write("{\"error\":\"Rate limit exceeded\"}");
                    return false;  // Stop the request here
                }
            }
        }
        return true;
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authInterceptor)
                .order(1)
                .addPathPatterns("/api/**")
                .excludePathPatterns("/api/health", "/api/public/**");

        registry.addInterceptor(rateLimitInterceptor)
                .order(2)
                .addPathPatterns("/api/**");

        registry.addInterceptor(loggingInterceptor)
                .order(3);
    }
}

// What happens inside ha.handle():
public ModelAndView handle(HttpServletRequest request,
                           HttpServletResponse response,
                           Object handler) throws Exception {

    HandlerMethod handlerMethod = (HandlerMethod) handler;

    // 1. Create argument array — one entry per method parameter
    Object[] args = new Object[handlerMethod.getMethodParameters().length];
    for (int i = 0; i < args.length; i++) {
        MethodParameter param = handlerMethod.getMethodParameters()[i];
        // Find the right ArgumentResolver and resolve this parameter
        args[i] = argumentResolvers.resolveArgument(param, mavContainer,
                                                     webRequest, binderFactory);
    }

    // 2. Invoke the method via reflection
    Object returnValue = handlerMethod.getMethod().invoke(
        handlerMethod.getBean(), args);

    // 3. Process the return value
    returnValueHandlers.handleReturnValue(returnValue, handlerMethod.getReturnType(),
                                          mavContainer, webRequest);
}

// Step 1: Define the annotation
@Target(ElementType.PARAMETER)
@Retention(RetentionPolicy.RUNTIME)
public @interface CurrentUser {
}

// Step 2: Implement the resolver
@Component
public class CurrentUserArgumentResolver implements HandlerMethodArgumentResolver {

    private final JwtTokenProvider tokenProvider;
    private final UserRepository userRepository;

    @Override
    public boolean supportsParameter(MethodParameter parameter) {
        return parameter.hasParameterAnnotation(CurrentUser.class)
            && parameter.getParameterType().equals(User.class);
    }

    @Override
    public Object resolveArgument(MethodParameter parameter,
                                  ModelAndViewContainer mavContainer,
                                  NativeWebRequest webRequest,
                                  WebDataBinderFactory binderFactory) {

        HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class);
        String token = extractBearerToken(request);

        if (token == null) {
            throw new UnauthorizedException("Missing Bearer token");
        }

        Long userId = tokenProvider.getUserIdFromToken(token);
        return userRepository.findById(userId)
            .orElseThrow(() -> new UnauthorizedException("User not found"));
    }

    private String extractBearerToken(HttpServletRequest request) {
        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            return header.substring(7);
        }
        return null;
    }
}

// Step 3: Register it
@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Override
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
        resolvers.add(currentUserArgumentResolver);
    }
}

// Step 4: Use it — clean controller methods
@RestController
@RequestMapping("/api/orders")
public class OrderController {

    @PostMapping
    public ResponseEntity<Order> createOrder(@CurrentUser User user,
                                             @Valid @RequestBody CreateOrderRequest request) {
        Order order = orderService.create(user, request);
        return ResponseEntity.status(201).body(order);
    }
}

@RestController
@RequestMapping("/api/orders")
@RequiredArgsConstructor
public class OrderController {

    private final OrderService orderService;
    private final OrderMapper orderMapper;

    @GetMapping("/{id}")
    public ResponseEntity<OrderResponse> getOrder(@PathVariable Long id) {
        Order order = orderService.findById(id)
            .orElseThrow(() -> new ResourceNotFoundException("Order", id));
        return ResponseEntity.ok(orderMapper.toResponse(order));
    }

    @GetMapping
    public ResponseEntity<Page<OrderSummaryResponse>> listOrders(
            @CurrentUser User user,
            @RequestParam(defaultValue = "0") int page,
            @RequestParam(defaultValue = "20") int size,
            @RequestParam(defaultValue = "createdAt,desc") String sort) {

        Pageable pageable = PageRequest.of(page, size, Sort.by(parseSortOrders(sort)));
        Page<Order> orders = orderService.findByUser(user.getId(), pageable);
        return ResponseEntity.ok(orders.map(orderMapper::toSummary));
    }

    @PostMapping
    public ResponseEntity<OrderResponse> createOrder(
            @CurrentUser User user,
            @Valid @RequestBody CreateOrderRequest request) {

        Order order = orderService.create(user, request);
        URI location = URI.create("/api/orders/" + order.getId());
        return ResponseEntity.created(location).body(orderMapper.toResponse(order));
    }

    @PutMapping("/{id}")
    public ResponseEntity<OrderResponse> updateOrder(
            @PathVariable Long id,
            @CurrentUser User user,
            @Valid @RequestBody UpdateOrderRequest request) {

        Order order = orderService.update(id, user, request);
        return ResponseEntity.ok(orderMapper.toResponse(order));
    }

    @DeleteMapping("/{id}")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void cancelOrder(@PathVariable Long id, @CurrentUser User user) {
        orderService.cancel(id, user);
    }
}

@GetMapping("/{id}")
public ResponseEntity<OrderResponse> getOrder(@PathVariable Long id) {
    return orderService.findById(id)
        .map(order -> ResponseEntity.ok()
            .header("X-Order-Version", String.valueOf(order.getVersion()))
            .cacheControl(CacheControl.maxAge(30, TimeUnit.SECONDS))
            .body(orderMapper.toResponse(order)))
        .orElse(ResponseEntity.notFound().build());
}

// Supporting multiple formats from the same endpoint
@GetMapping(value = "/orders/{id}",
            produces = {MediaType.APPLICATION_JSON_VALUE, MediaType.APPLICATION_XML_VALUE})
public Order getOrder(@PathVariable Long id) {
    return orderService.findById(id).orElseThrow();
}
// Client sends Accept: application/xml → gets XML
// Client sends Accept: application/json → gets JSON

public class CsvHttpMessageConverter extends AbstractHttpMessageConverter<List<?>> {

    public CsvHttpMessageConverter() {
        super(new MediaType("text", "csv"));
    }

    @Override
    protected boolean supports(Class<?> clazz) {
        return List.class.isAssignableFrom(clazz);
    }

    @Override
    protected void writeInternal(List<?> objects, HttpOutputMessage outputMessage)
            throws IOException {
        OutputStreamWriter writer = new OutputStreamWriter(outputMessage.getBody());
        // Use OpenCSV or Apache Commons CSV to write
        StatefulBeanToCsv<Object> beanToCsv = new StatefulBeanToCsvBuilder<>(writer).build();
        beanToCsv.write((List<Object>) objects);
        writer.flush();
    }

    @Override
    protected List<?> readInternal(Class<? extends List<?>> clazz,
                                   HttpInputMessage inputMessage) {
        throw new UnsupportedOperationException("CSV reading not supported");
    }
}

// Register it
@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Override
    public void extendMessageConverters(List<HttpMessageConverter<?>> converters) {
        converters.add(new CsvHttpMessageConverter());
    }
}

// Now this works:
// GET /api/orders with Accept: text/csv → returns CSV file

@Configuration
public class JacksonConfig {

    @Bean
    public ObjectMapper objectMapper() {
        return JsonMapper.builder()
            .addModule(new JavaTimeModule())
            .addModule(new Jdk8Module())
            .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
            .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
            .enable(DeserializationFeature.FAIL_ON_NULL_FOR_PRIMITIVES)
            .serializationInclusion(JsonInclude.Include.NON_NULL)
            .propertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE)
            .build();
    }
}

// Server-rendered controller — ViewResolver IS invoked
@Controller
public class OrderPageController {

    @GetMapping("/orders")
    public String listOrders(Model model, @CurrentUser User user) {
        model.addAttribute("orders", orderService.findByUser(user.getId()));
        model.addAttribute("totalCount", orderService.countByUser(user.getId()));
        return "orders/list";  // → Thymeleaf renders templates/orders/list.html
    }
}

@RestControllerAdvice
@Slf4j
public class GlobalExceptionHandler {

    // --- Business exceptions ---

    @ExceptionHandler(ResourceNotFoundException.class)
    public ResponseEntity<ProblemDetail> handleNotFound(ResourceNotFoundException ex,
                                                        HttpServletRequest request) {
        ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.NOT_FOUND);
        problem.setTitle("Resource Not Found");
        problem.setDetail(ex.getMessage());
        problem.setInstance(URI.create(request.getRequestURI()));
        problem.setProperty("timestamp", Instant.now());
        problem.setProperty("resourceType", ex.getResourceType());
        problem.setProperty("resourceId", ex.getResourceId());
        return ResponseEntity.status(404).body(problem);
    }

    @ExceptionHandler(BusinessRuleViolationException.class)
    public ResponseEntity<ProblemDetail> handleBusinessRule(BusinessRuleViolationException ex) {
        ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.UNPROCESSABLE_ENTITY);
        problem.setTitle("Business Rule Violation");
        problem.setDetail(ex.getMessage());
        problem.setProperty("ruleCode", ex.getRuleCode());
        return ResponseEntity.status(422).body(problem);
    }

    // --- Validation errors ---

    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<ProblemDetail> handleValidation(MethodArgumentNotValidException ex) {
        ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.BAD_REQUEST);
        problem.setTitle("Validation Failed");
        problem.setDetail("One or more fields have invalid values");

        List<Map<String, String>> fieldErrors = ex.getBindingResult().getFieldErrors()
            .stream()
            .map(error -> Map.of(
                "field", error.getField(),
                "rejected", String.valueOf(error.getRejectedValue()),
                "message", error.getDefaultMessage()
            ))
            .toList();
        problem.setProperty("errors", fieldErrors);
        return ResponseEntity.badRequest().body(problem);
    }

    @ExceptionHandler(ConstraintViolationException.class)
    public ResponseEntity<ProblemDetail> handleConstraintViolation(ConstraintViolationException ex) {
        ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.BAD_REQUEST);
        problem.setTitle("Constraint Violation");

        List<String> violations = ex.getConstraintViolations().stream()
            .map(v -> v.getPropertyPath() + ": " + v.getMessage())
            .toList();
        problem.setProperty("violations", violations);
        return ResponseEntity.badRequest().body(problem);
    }

    // --- Catch-all ---

    @ExceptionHandler(Exception.class)
    public ResponseEntity<ProblemDetail> handleUnexpected(Exception ex,
                                                          HttpServletRequest request) {
        log.error("Unhandled exception at {} {}", request.getMethod(),
                  request.getRequestURI(), ex);

        ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.INTERNAL_SERVER_ERROR);
        problem.setTitle("Internal Server Error");
        problem.setDetail("An unexpected error occurred. Please contact support.");
        // NEVER expose stack trace or internal details to client
        return ResponseEntity.internalServerError().body(problem);
    }
}

// This works because SecurityContext is on the same thread
@GetMapping("/me")
public User getCurrentUser() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    return (User) auth.getPrincipal();  // Same thread → same SecurityContext
}

// THIS BREAKS — new thread doesn't have SecurityContext
@GetMapping("/async-broken")
public CompletableFuture<User> getBrokenAsync() {
    return CompletableFuture.supplyAsync(() -> {
        // Different thread! SecurityContextHolder is empty here!
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        return (User) auth.getPrincipal();  // NullPointerException
    });
}

// FIX — propagate context manually or use DelegatingSecurityContextExecutor
@GetMapping("/async-fixed")
public CompletableFuture<User> getFixedAsync() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    return CompletableFuture.supplyAsync(() -> {
        SecurityContextHolder.getContext().setAuthentication(auth);
        try {
            return (User) auth.getPrincipal();
        } finally {
            SecurityContextHolder.clearContext();
        }
    });
}

@Configuration
public class ContentNegotiationConfig implements WebMvcConfigurer {

    @Override
    public void configureContentNegotiation(ContentNegotiationConfigurer configurer) {
        configurer
            .favorParameter(true)          // Enable ?format=json
            .parameterName("format")
            .defaultContentType(MediaType.APPLICATION_JSON)
            .mediaType("json", MediaType.APPLICATION_JSON)
            .mediaType("xml", MediaType.APPLICATION_XML)
            .mediaType("csv", new MediaType("text", "csv"));
    }
}

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    @GetMapping(value = "/{id}", produces = {
        MediaType.APPLICATION_JSON_VALUE,
        MediaType.APPLICATION_XML_VALUE,
        "text/csv"
    })
    public Order getOrder(@PathVariable Long id) {
        return orderService.findById(id).orElseThrow();
    }
}