spring-boot request lifecycle

HTTP Request
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 1. Servlet Container (Tomcat/Undertow)              │
│    → Cấp phát Thread (Virtual Thread / Platform)    │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 2. Filter Chain (Jakarta Servlet Filters)           │
│    → RequestTracingFilter (MDC, TraceId)            │
│    → Custom Filters (CORS, Logging...)              │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 3. SecurityFilterChain (Spring Security)            │
│    → CsrfFilter, BearerTokenAuthenticationFilter... │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 4. DispatcherServlet & HandlerMapping               │
│    → Ánh xạ URL → Controller Method                 │
│    → HandlerInterceptor.preHandle()                 │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 5. Argument Resolution & Validation                 │
│    → HttpMessageConverter (Jackson: JSON → Object)  │
│    → Jakarta Bean Validation (@Valid)               │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 6. Controller Layer (@RestController)               │
│    → Kích hoạt AOP Proxies (@PreAuthorize...)       │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 7. Service Layer (@Service)                         │
│    → Transactional Proxy (Begin TX)                 │
│    → Thực thi Business Logic & Event Publishing     │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 8. Data Access Layer (Repository)                   │
│    → JPA/Hibernate Session & Dirty Checking         │
│    → Mượn Connection từ Pool (HikariCP) → SQL       │
└─────────────────────────────────────────────────────┘
 │
 ▼ (Dòng chảy Response - Ngược chiều)
┌─────────────────────────────────────────────────────┐
│ 9. Trả về Controller & Xử lý Exception              │
│    → Commit/Rollback TX                             │
│    → @RestControllerAdvice (nếu có lỗi)             │
└─────────────────────────────────────────────────────┘
 │
 ▼
┌─────────────────────────────────────────────────────┐
│ 10. Response Processing & Serialization             │
│     → Interceptor.postHandle()                      │
│     → HttpMessageConverter (Object → JSON)          │
│     → Interceptor.afterCompletion()                 │
└─────────────────────────────────────────────────────┘
 │
 ▼
HTTP Response

server:
  port: 8080
  servlet:
    context-path: /console
  tomcat:
    threads:
      max: 200 # max worker threads (ignored if virtual threads enabled)
      min-spare: 10
    max-connections: 8192
    accept-count: 100
 
# Virtual threads → mỗi request 1 virtual thread, no pool limit
spring:
  threads:
    virtual:
      enabled: true

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class RequestTracingFilter extends OncePerRequestFilter {
 
    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
 
        String traceId = Optional.ofNullable(request.getHeader("X-Request-Id"))
                                 .orElseGet(() -> UUID.randomUUID().toString());
 
        MDC.put("requestId", traceId); // Gắn vào Mapped Diagnostic Context
        response.setHeader("X-Request-Id", traceId);
 
        long start = System.nanoTime();
        try {
            chain.doFilter(request, response); // Chuyền tay cho Filter tiếp theo
        } finally {
            long duration = (System.nanoTime() - start) / 1_000_000;
            log.info("[traceId={}] {} {} → {} ({}ms)",
                traceId, request.getMethod(), request.getRequestURI(),
                response.getStatus(), duration);
            MDC.clear(); // Bắt buộc phải dọn dẹp để tránh rò rỉ context giữa các Thread
        }
    }
}

// DispatcherServlet pseudocode:
HandlerExecutionChain chain = handlerMapping.getHandler(request);
// chain = controller method + interceptors
 
// Run interceptors pre-handle
for (HandlerInterceptor interceptor : chain.getInterceptors()) {
   if (!interceptor.preHandle(request, response, handler)) {
       return; // short-circuit
   }
}
 
// Invoke controller method
ModelAndView mv = handlerAdapter.handle(request, response, handler);
 
// Run interceptors post-handle
for (HandlerInterceptor interceptor : chain.getInterceptors()) {
   interceptor.postHandle(request, response, handler, mv);
}

@Component
public class AuditInterceptor implements HandlerInterceptor {
 
   @Override
   public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
                            Object handler) {
       // Runs AFTER security filters, BEFORE controller
       // handler = HandlerMethod (controller method info)
       if (handler instanceof HandlerMethod hm) {
           log.info("Calling {}.{}()", hm.getBeanType().getSimpleName(), hm.getMethod().getName());
       }
       return true; // continue chain
   }
 
   @Override
   public void postHandle(HttpServletRequest request, HttpServletResponse response,
                          Object handler, ModelAndView modelAndView) {
       // After controller, before response written (only if no exception)
   }
 
   @Override
   public void afterCompletion(HttpServletRequest request, HttpServletResponse response,
                               Object handler, Exception ex) {
       // Always runs — even if exception thrown
       // Good for cleanup
   }
}
 
// Register
@Configuration
public class WebConfig implements WebMvcConfigurer {
   @Override
   public void addInterceptors(InterceptorRegistry registry) {
       registry.addInterceptor(auditInterceptor)
           .addPathPatterns("/api/**")
           .excludePathPatterns("/api/public/**");
   }
}

@RestController
@RequestMapping("/api/orders")
@RequiredArgsConstructor
public class OrderController {
 
   @PostMapping
   public ResponseEntity<APIResponse<OrderDTO>> createOrder(
           @Valid @RequestBody CreateOrderRequest request,  // ← Jackson deserialize + validate
           @AuthenticationPrincipal Jwt jwt,                // ← extract from SecurityContext
           @RequestHeader("X-Workspace-Id") UUID workspaceId // ← header extraction
   ) {
       // If @Valid fails → MethodArgumentNotValidException → @ExceptionHandler
       // If type conversion fails → TypeMismatchException
       // If body missing → HttpMessageNotReadableException
   }
}

@RestController
@RequiredArgsConstructor
public class OrderController {
   private final OrderService orderService; // ← injected PROXY, not real instance
 
   @PostMapping("/api/orders")
   public ResponseEntity<?> create(@Valid @RequestBody CreateOrderRequest req,
                                   @AuthenticationPrincipal Jwt jwt) {
       OrderDTO result = orderService.createOrder(req, jwt.getSubject());
       return ResponseEntity.status(201).body(APIResponse.success(result));
   }
}

@Service
@RequiredArgsConstructor
@Slf4j
public class OrderService {
   private final OrderRepository orderRepo;
   private final ProductService productService;
   private final ApplicationEventPublisher eventPublisher;
 
   @Transactional
   public OrderDTO createOrder(CreateOrderRequest req, String userId) {
       // 1. Business validation
       Product product = productService.getById(req.getProductId());
       if (!product.isAvailable()) {
           throw new BusinessException("PRODUCT_UNAVAILABLE");
       }
 
       // 2. Create entity
       Order order = Order.builder()
           .customerId(userId)
           .productId(product.getId())
           .quantity(req.getQuantity())
           .status(OrderStatus.PENDING)
           .build();
 
       // 3. Persist (Hibernate dirty checking → INSERT SQL)
       Order saved = orderRepo.save(order);
 
       // 4. Publish event (async via multicaster)
       eventPublisher.publishEvent(new OrderCreatedEvent(this, saved));
 
       // 5. Map to DTO
       return OrderMapper.INSTANCE.toDTO(saved);
   }
   // If exception → @Transactional proxy rollbacks
   // If success → @Transactional proxy commits
}

public interface OrderRepository extends JpaRepository<Order, UUID> {
   // Spring Data generates implementation at runtime
}

spring:
  datasource:
    hikari:
      maximum-pool-size: 20
      minimum-idle: 5
      idle-timeout: 300000
      connection-timeout: 20000
      max-lifetime: 1200000

@RestControllerAdvice
@Slf4j
public class GlobalExceptionHandler {
 
   // Validation errors
   @ExceptionHandler(MethodArgumentNotValidException.class)
   public ResponseEntity<APIResponse<?>> handleValidation(MethodArgumentNotValidException ex) {
       List<String> errors = ex.getBindingResult().getFieldErrors().stream()
           .map(e -> e.getField() + ": " + e.getDefaultMessage())
           .toList();
       return ResponseEntity.badRequest()
           .body(APIResponse.error("VALIDATION_ERROR", errors));
   }
 
   // Business exceptions
   @ExceptionHandler(BusinessException.class)
   public ResponseEntity<APIResponse<?>> handleBusiness(BusinessException ex) {
       log.warn("[traceId={}] Business error: {}", RequestContext.getRequestId(), ex.getMessage());
       return ResponseEntity.badRequest()
           .body(APIResponse.error(ex.getCode(), ex.getMessage()));
   }
 
   // Not found
   @ExceptionHandler(EntityNotFoundException.class)
   public ResponseEntity<APIResponse<?>> handleNotFound(EntityNotFoundException ex) {
       return ResponseEntity.status(404)
           .body(APIResponse.error("NOT_FOUND", ex.getMessage()));
   }
 
   // Catch-all
   @ExceptionHandler(Exception.class)
   public ResponseEntity<APIResponse<?>> handleUnexpected(Exception ex) {
       log.error("[traceId={}] Unexpected error", RequestContext.getRequestId(), ex);
       return ResponseEntity.status(500)
           .body(APIResponse.error("INTERNAL_ERROR", "An unexpected error occurred"));
   }
}

// Controller returns object → Jackson serializes to JSON
@GetMapping("/orders/{id}")
public OrderDTO getOrder(@PathVariable UUID id) {
   return orderService.getById(id); // ← Jackson calls getters, serializes
}

@Configuration
public class JacksonConfig {
   @Bean
   public ObjectMapper objectMapper() {
       return JsonMapper.builder()
           .addModule(new JavaTimeModule())
           .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
           .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
           .serializationInclusion(JsonInclude.Include.NON_NULL)
           .build();
   }
}