DEV Community: Chanbong Park

Serving Static and JSP Resources in Spring Boot: A Guide for Legacy Integration

Chanbong Park — Fri, 21 Mar 2025 12:10:37 +0000

If you’re modernizing a legacy Java application, chances are you’re dealing with JSP files. In this post, we’ll walk through how to configure a Spring Boot application to serve both static resources and dynamic JSP pages — a common need when migrating or integrating legacy systems.

This article is based on the open-source project spring-webserver-demo, which provides a simple yet effective example.

Why JSP in 2025?

Although modern web applications typically use frontend frameworks like React or Vue, many enterprise systems still rely heavily on JSP. Being able to reuse those JSP files in a Spring Boot environment allows teams to:

Gradually migrate to newer tech stacks
Maintain and extend existing features
Avoid rewriting large volumes of legacy code

Project Overview

This demo shows how to:

Serve static content such as HTML, CSS, and JS from the /static directory
Render JSP pages from /WEB-INF/jsp for dynamic content
Configure Spring Boot to support JSP (not enabled by default)

GitHub repository: siprikorea/spring-webserver-demo

Project Structure

spring-webserver-demo/
├── src/
│   ├── main/
│   │   ├── java/com/siprikorea//webserver/
│   │   │   └── JspController.java
│   │   └── webapp/WEB-INF/jsp/
│   │       └── index.jsp
│   └── resources/static/
│       └── index.html
├── build.gradle
└── application.yml

Configuring JSP in Spring Boot

Spring Boot does not support JSP by default, so a few adjustments are needed.

application.yml

spring:
  mvc:
    view:
      prefix: /WEB-INF/jsp/
      suffix: .jsp

Required Dependencies (Gradle)

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-web'
    providedRuntime 'org.apache.tomcat.embed:tomcat-embed-jasper'
    compileOnly 'javax.servlet:javax.servlet-api:4.0.1'
}

tomcat-embed-jasper is needed to compile and render JSP
javax.servlet-api is provided at runtime by the servlet container

JSP File Location

Make sure JSP files are placed in:

src/main/webapp/WEB-INF/jsp/

This is essential because JSPs are handled by the servlet engine, not Spring’s default resource resolvers.

How to Run the Demo

Clone the project:

git clone https://github.com/siprikorea/spring-webserver-demo.git
cd spring-webserver-demo
./gradlew bootRun

Once running, the server will be available at http://localhost:8080.

Testing the Application

Static Resource

Access http://localhost:8080/index.html
→ This should display a static HTML page located in resources/static.

JSP Page

Access http://localhost:8080/jsp/time
→ This will render time.jsp from WEB-INF/jsp via Spring MVC.

When to Use This Setup

This approach is ideal when:

You’re migrating from a legacy system that uses JSP
You want to reuse JSPs without rewriting them immediately
You’re maintaining existing features while modernizing incrementally

Conclusion

Spring Boot doesn’t support JSP out of the box, but with a few configurations, it’s completely possible to serve both static and JSP-based dynamic content. This allows teams to modernize Java web applications step by step without sacrificing stability or increasing risk.

For the full working example, check out the repository:
👉 GitHub - siprikorea/spring-webserver-demo

Compose for Desktop - Project UI Structure and Theme Application

Chanbong Park — Sat, 01 Mar 2025 06:12:49 +0000

In this post, we will explore how to structure the UI in a Compose for Desktop project, apply dark mode themes, and implement navigation functionality.
Additionally, we will introduce reusable UI components (Components) and demonstrate how to utilize them effectively.

Project Structure

For this example, we will organize the project as follows:

📂 src/jvmMain/kotlin/

📁 ui/
   ├── 📄 HomeScreen.kt         # Home screen
   ├── 📄 SettingsScreen.kt     # Settings screen
   ├── 📄 Navigation.kt         # Screen navigation management
   ├── 📄 Theme.kt              # Light/Dark theme management
   ├── 📄 Components.kt         # Reusable UI components
📄 Main.kt                      # Application entry point

Theme.kt (Dark/Light Theme Application)

To support theme switching, we use a global ThemeController to manage theme state.

package ui

import androidx.compose.material.*
import androidx.compose.runtime.Composable
import androidx.compose.runtime.getValue
import androidx.compose.runtime.mutableStateOf
import androidx.compose.runtime.setValue

private val DarkColorPalette = darkColors(
    primary = androidx.compose.ui.graphics.Color(0xFFBB86FC),
    primaryVariant = androidx.compose.ui.graphics.Color(0xFF3700B3),
    secondary = androidx.compose.ui.graphics.Color(0xFF03DAC5)
)

private val LightColorPalette = lightColors(
    primary = androidx.compose.ui.graphics.Color(0xFF6200EE),
    primaryVariant = androidx.compose.ui.graphics.Color(0xFF3700B3),
    secondary = androidx.compose.ui.graphics.Color(0xFF03DAC5)
)

object ThemeController {
    var isDarkMode by mutableStateOf(false)
}

@Composable
fun AppTheme(content: @Composable () -> Unit) {
    val colors = if (ThemeController.isDarkMode) DarkColorPalette else LightColorPalette

    MaterialTheme(
        colors = colors,
        typography = Typography(),
        shapes = Shapes(),
        content = content
    )
}

ThemeController.isDarkMode manages the global theme state.
AppTheme applies the dark or light theme dynamically based on the theme state.

HomeScreen.kt (Home Screen)

The home screen displays a welcome card using a reusable UI component (SimpleCard).

package ui.screens

import androidx.compose.foundation.layout.*
import androidx.compose.material.*
import androidx.compose.runtime.Composable
import androidx.compose.ui.Modifier
import androidx.compose.ui.unit.dp
import ui.Screen

@Composable
fun HomeScreen(onNavigate: (Screen) -> Unit) {
    Scaffold(
        topBar = { TopAppBar(title = { Text("Home") }) }
    ) {
        Column(
            modifier = Modifier.fillMaxSize().padding(16.dp),
            verticalArrangement = Arrangement.Center
        ) {
            Text("Welcome to Compose for Desktop!", style = MaterialTheme.typography.h5)
            Spacer(modifier = Modifier.height(20.dp))
            Button(onClick = { onNavigate(Screen.SETTINGS) }) {
                Text("Go to Settings")
            }
        }
    }
}

Uses SimpleCard for consistent UI elements.
Clicking the button triggers onNavigate(Screen.SETTINGS), navigating to the Settings screen.

SettingsScreen.kt (Settings Screen)

The settings screen features a dark mode toggle switch.

package ui.screens

import androidx.compose.foundation.layout.*
import androidx.compose.material.*
import androidx.compose.runtime.Composable
import androidx.compose.ui.Modifier
import androidx.compose.ui.unit.dp
import ui.Screen
import ui.ThemeController
import ui.components.SimpleCard

@Composable
fun SettingsScreen(onNavigate: (Screen) -> Unit) {
    Scaffold(
        topBar = { TopAppBar(title = { Text("Settings") }) }
    ) {
        Column(
            modifier = Modifier.fillMaxSize().padding(16.dp),
            verticalArrangement = Arrangement.Center
        ) {
            SimpleCard(title = "Settings", content = "Customize your app preferences.")
            Spacer(modifier = Modifier.height(10.dp))

            Row(
                modifier = Modifier.fillMaxWidth(),
                horizontalArrangement = Arrangement.SpaceBetween
            ) {
                Text("Dark Mode")
                Switch(
                    checked = ThemeController.isDarkMode,
                    onCheckedChange = { ThemeController.isDarkMode = it }
                )
            }
            Spacer(modifier = Modifier.height(20.dp))
            Button(onClick = { onNavigate(Screen.HOME) }) {
                Text("Back to Home")
            }
        }
    }
}

The Switch button toggles dark mode on/off.
Updating ThemeController.isDarkMode instantly changes the theme across the app.

Components.kt (Reusable UI Components)

We define reusable UI elements such as SimpleCard.

package ui.components

import androidx.compose.foundation.layout.*
import androidx.compose.material.Card
import androidx.compose.material.MaterialTheme
import androidx.compose.material.Text
import androidx.compose.runtime.Composable
import androidx.compose.ui.Modifier
import androidx.compose.ui.unit.dp

@Composable
fun SimpleCard(title: String, content: String) {
    Card(
        modifier = Modifier.fillMaxWidth().padding(8.dp),
        elevation = 4.dp
    ) {
        Column(modifier = Modifier.padding(16.dp)) {
            Text(text = title, style = MaterialTheme.typography.h6)
            Spacer(modifier = Modifier.height(8.dp))
            Text(text = content, style = MaterialTheme.typography.body2)
        }
    }
}

SimpleCard provides a consistent UI structure.
Used in both HomeScreen and SettingsScreen for uniform styling.

Main.kt (Application Entry Point)

Finally, we wrap everything inside AppTheme and launch NavigationController.

import androidx.compose.ui.window.Window
import androidx.compose.ui.window.application
import ui.AppTheme
import ui.NavigationController

fun main() = application {
    Window(onCloseRequest = ::exitApplication, title = "Compose Desktop App") {
        AppTheme {
            NavigationController()
        }
    }
}

🚀 Running the Application

Run the following command to start the application:

gradle run

The Home Screen is displayed by default.
Clicking “Go to Settings” navigates to the Settings screen.
Toggling the Dark Mode switch updates the entire app’s theme instantly.

Now, you can expand this template with more features and additional screens as needed! 😃

Getting Started with Compose for Desktop: Build Your First App

Chanbong Park — Sat, 15 Feb 2025 04:24:56 +0000

Post Overview

1. Introduction to Compose for Desktop

Compose for Desktop is an extension of Jetpack Compose that allows building desktop applications using Kotlin.
Supports multiple platforms (Windows, macOS, Linux).
Provides a modern UI development approach compared to Swing.

2. Setting Up the Environment

Install JDK 17 or higher.
Install IntelliJ IDEA (Ultimate or Community).
Create a Gradle project and configure Compose for Desktop.

3. Building a Simple Sample App

A basic GUI app that displays “Hello, Compose for Desktop!” with a button.

Creating a Simple Sample App

Here’s how to build a basic Compose for Desktop application.

1. Gradle Project Setup

Modify your build.gradle.kts file to include Compose for Desktop.

plugins {
    kotlin("jvm")
    id("org.jetbrains.compose")
    id("org.jetbrains.kotlin.plugin.compose")
}

group = "com.example"
version = "1.0-SNAPSHOT"

repositories {
    mavenCentral()
    google()
}

dependencies {
    implementation(compose.desktop.currentOs)
}

compose.desktop {
    application {
        mainClass = "MainKt"
    }
}

2. Writing the Main Code

Create a file src/main/kotlin/Main.kt and add the following code:

import androidx.compose.desktop.ui.tooling.preview.Preview
import androidx.compose.foundation.layout.*
import androidx.compose.material.Button
import androidx.compose.material.MaterialTheme
import androidx.compose.material.Text
import androidx.compose.runtime.*
import androidx.compose.ui.*
import androidx.compose.ui.unit.dp
import androidx.compose.ui.window.*

fun main() = application {
    Window(onCloseRequest = ::exitApplication, title = "Compose for Desktop App") {
        App()
    }
}

@Composable
@Preview
fun App() {
    var count by remember { mutableStateOf(0) }

    Column(
        modifier = Modifier.padding(16.dp),
        verticalArrangement = Arrangement.spacedBy(8.dp)
    ) {
        Text("Hello, Compose for Desktop!", style = MaterialTheme.typography.h3)
        Button(onClick = { count++ }) {
            Text("Click me: $count")
        }
    }
}

3. Running the App

Run the following command in the terminal:

./gradlew run

Or simply run Main.kt from IntelliJ IDEA.
That’s it! You now have a basic Compose for Desktop application up and running. 🚀

HSTS (HTTP Strict Transport Security)

Chanbong Park — Sun, 02 Feb 2025 05:35:19 +0000

1. What is HSTS?

HSTS (HTTP Strict Transport Security) is a web security mechanism in which a web server instructs the browser to allow only HTTPS connections for a specific domain. This helps prevent MITM (man-in-the-middle) attacks and protocol downgrade attacks. It is considered an essential security measure for services handling finance, e-commerce, and personal data.

2. How HSTS Works

The server sends a security policy to the client by including the Strict-Transport-Security header.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

3. HSTS Header Options

max-age: The duration for which the policy is valid (in seconds).
includeSubDomains: Applies the HSTS policy to all subdomains.
preload: Requests that the domain be added to the browser’s HSTS preload list.

Once the browser receives the HSTS policy, it will force HTTPS connections for the specified domain for the duration indicated (e.g., 31,536,000 seconds).

4. Advantages

Prevents MITM attacks: By enforcing HTTPS, it blocks potential MITM attacks.
Prevents protocol downgrade attacks: Ensures that connections do not fall back to insecure HTTP.

5. Precautions

Misconfiguration Risks: Incorrect HSTS settings can make service recovery difficult.
SSL/TLS Management: Proper configuration of HTTPS and timely management of SSL certificates are essential.

6. HSTS Preload List

The HSTS Preload List is a list built into major browsers (Chrome, Firefox, Edge, Safari, etc.) that enforces HTTPS connections for domains that are registered on the list.

You can submit your domain for inclusion at the HSTS Preload website.
Once approved, the domain will be added to the browser’s preload list when the browser is updated.
Even if a user tries to access the domain via HTTP, the browser will automatically redirect the request to HTTPS.

Benefits of the Preload List

Enhanced Security: Browsers enforce HTTPS from the first request, preventing MITM attacks.
No Initial HTTP Request: Direct connection via HTTPS reduces the chance of insecure communication.
Compliance with Modern Security Policies: Ensures that domains meet current security standards.

Registration Requirements for the Preload List

All domains and subdomains must have a valid SSL/TLS certificate.
The Strict-Transport-Security header must include both the includeSubDomains and preload options.
The domain must be submitted and registered via hstspreload.org.

Registration Requirements for the Preload List

All domains and subdomains must have a valid SSL/TLS certificate.
The Strict-Transport-Security header must include both the includeSubDomains and preload options.
The domain must be submitted and registered via hstspreload.org.

Registration and Implementation Process

1. Site Verification

Ensure that all HTTPS configurations are correctly set up.
Verify that the Strict-Transport-Security header contains the required values.

2. Submission

Enter your domain name at hstspreload.org and submit a registration request.

3. Review

The system automatically validates your HSTS configuration.
If errors are detected, the request will be rejected. You must resolve any issues before reapplying.

4. List Inclusion

Once approved, your domain is added to the preload list embedded in the browser source code.

5. Browser Update

The updated preload list is distributed with browser updates.
It may take several weeks to months for the changes to propagate to all users.

Because the HSTS Preload List is hard-coded into the browser source code, a new domain’s HSTS policy will not take effect until the browser is updated.

For example, in Chromium-based browsers, the preload list is directly included in the source code. Therefore, adding a new domain requires both an update of the browser source code and that users update their browsers.

To add your domain to the preload list, visit hstspreload.org and submit your registration request. Note that even after approval, it might take time for the changes to reach all users.

Chrome Specifics

Source Code Path:

src/net/http/transport_security_state_static.json

GitHub Link: Chromium HSTS Preload List

Browsers such as Firefox, Safari, Opera, and Edge also use Chrome’s HSTS preload list.