A Java EE Servlet, or servlet for short, lives inside a servlet container, which is usually an application server, for example, Tomcat (https://tomcat.apache.org). When an HTTP request arrives at a server, usually, it will go through a list of filters that perform filtering tasks, for example, authentication, logging, and auditing. And if the request doesn't get returned by any filter, the application server will hand it over to a servlet that is registered to process those requests that contain a URI that matches a certain pattern. Once the servlet finishes processing the request, an HTTP response will be sent back to the client after going through the same set of filters that processed the corresponding HTTP request.

Inside these filters, you can perform additional filtering tasks, such as adding certain HTTP headers to the response. The following diagram shows this flow:

In Java EE, for every HTTP request, an instance of HttpServletRequest is created. And for every HTTP response, an instance of HttpServletResponse is created. To identify a user across multiple requests, the application server will create an instance of HttpSession upon receiving the first request. Each of the HttpSession instances has an ID, called a session ID. And the session id will be sent to the client in the HTTP response headers as a cookie. The client will store the cookie and send it back to the server in the next request. In this way, the server can recognize a user by looking up the HttpSession instance using the session ID found in the cookie.

In Java EE, you can create listeners to listen to events of HttpSession life cycle changes by implementing the HttpSessionListener interface or to listen to life cycle requests by implementing the ServletRequestListener interface.

To create a servlet, you can extend javax.servlet.http.HttpServlet and either annotate it with the @WebServlet annotation or register it in the traditional web.xml file, which is the configuration file for a Java EE web application. Either way, you need to map this servlet to one or more URI patterns so that the server can route requests of matching URIs to it.

Also, in a servlet, you can overwrite the following methods:

• doGet, for processing the HTTP GET requests
• doPost, for processing the HTTP POST requests
• doPut, for processing the HTTP PUT requests
• doDelete, for processing the HTTP DELETE requests

Inside these methods are the places where the logic of your application starts. And when using a servlet, if you need to access shared resources, such as in-memory data or performing I/O, what you need to keep in mind is the fact that your servlet typically handles concurrent requests, and changes made by one request might affect other requests.