Client-Server Architecture in Java Web Applications

Course: Advanced Java Training

Topic: Client-Server Architecture in Java Web Applications

Course Link: Advanced Java Training Course

Demo Link: Register for a Course Demo

Website: JustAcademy Official Website

1. Introduction to Client-Server Architecture

Client-server architecture is a software architecture in which two major components, the client and the server, communicate over a network to exchange information and provide services. The client initiates a request, while the server receives the request, processes it, and returns a response.

In Java web applications, a client is commonly a web browser or mobile application, and the server runs Java application code that handles requests, applies business rules, interacts with databases, and generates responses.

For example, when a user logs in to an online shopping website, the browser sends login information to the server. The Java backend validates the request, checks the user record, and returns an appropriate response.

Learning Objectives

• Understand the client-server architecture and its purpose.
• Identify the roles of clients, web servers, application servers, and databases.
• Understand HTTP requests and responses.
• Learn how Java Servlets process client requests.
• Explore the role of JDBC and databases in web applications.
• Understand two-tier, three-tier, and multi-tier architecture.
• Learn about session management, security, and error handling.
• Build a simple Java web application using client-server communication.

2. What Is a Client?

A client is a program or device that requests information or services from a server. In web development, the client is usually the browser through which users interact with a website.

Responsibilities of a Client

• Display the application's user interface.
• Accept user input through forms, buttons, and other controls.
• Send HTTP requests to the server.
• Receive and display server responses.
• Perform suitable client-side validation and interface updates.
• Store limited client-side information when appropriate.

Examples of Clients

• Google Chrome, Microsoft Edge, and Mozilla Firefox.
• Mobile applications communicating with Java REST APIs.
• Desktop applications that retrieve information from backend services.
• API testing tools such as Postman.
• Automated programs that send HTTP requests.

Important: Client-side validation improves usability, but it must not replace server-side validation because clients can be modified or bypassed.

3. What Is a Server?

A server is a computer or software process that receives requests and provides responses or services. In Java web development, the server-side application implements business operations, validates data, communicates with databases, and determines what information should be returned to the client.

Responsibilities of a Server

• Receive and route incoming requests.
• Validate submitted information.
• Execute business logic.
• Authenticate users and enforce access permissions.
• Read and write information in databases.
• Generate HTML pages, JSON responses, or other supported formats.
• Handle exceptions and record diagnostic information.

Example

In an employee management application, the client submits a request to retrieve employee details. The Java server verifies that the request is permitted, retrieves the employee record through the data access layer, and returns the result.

4. Main Components of Java Client-Server Architecture

5. How Client-Server Communication Works

Client-server communication in a typical Java web application follows a request-response process. HTTP defines the application-level messages exchanged between clients and servers.

Step-by-Step Process

1. User action: The user opens a website, submits a form, or clicks a button.
2. Request creation: The browser creates an HTTP request containing the method, URL, headers, and, when applicable, a request body.
3. Network communication: The request travels to the server over the network, usually through a TCP connection or another supported transport arrangement.
4. Request routing: The web server or application server routes the request to the appropriate Java application component.
5. Request processing: A Servlet, controller, or other handler validates the input and invokes the relevant application logic.
6. Database interaction: The application accesses the database when the requested operation requires it.
7. Response creation: The server generates a response containing a status code, headers, and optional response data.
8. Client processing: The browser interprets the response and displays or updates the user interface.

Architecture Diagram

+----------------------------+
|       Client Browser       |
|   HTML, CSS, JavaScript    |
+-------------+--------------+
              |
              | HTTP / HTTPS Request
              v
+----------------------------+
|         Web Server         |
| Request Routing / Static   |
| Content / Reverse Proxy     |
+-------------+--------------+
              |
              v
+----------------------------+
|    Java Application Layer  |
| Servlet / Spring Controller|
| Business Service Layer     |
+-------------+--------------+
              |
              v
+----------------------------+
|       Data Access Layer    |
|       JDBC / JPA           |
+-------------+--------------+
              |
              v
+----------------------------+
|          Database          |
|       MySQL / PostgreSQL   |
+----------------------------+

Response travels back to the client.

Note: In smaller deployments, the web server and Java application may run together or the Java application may handle HTTP directly. A separate reverse proxy or web server is optional; the exact arrangement depends on the deployment architecture.

6. Understanding HTTP Requests and Responses

HTTP stands for Hypertext Transfer Protocol. It is the primary application-layer protocol used for communication between browsers and Java web applications. HTTPS adds transport encryption through TLS when configured correctly.

HTTP Request Structure

• Method: Specifies the requested operation, such as GET or POST.
• URL or path: Identifies the target resource or endpoint.
• Headers: Provide metadata, such as content type and accepted response formats.
• Body: Carries submitted data for methods and operations that use a request body.

Example HTTP Request

GET /employees HTTP/1.1
Host: example.com
Accept: application/json

This request asks the server to retrieve employee information. The application must still apply appropriate authorization before returning any protected records.

HTTP Response Structure

• Status code: Indicates the outcome of the request.
• Headers: Describe the response format and other metadata.
• Body: Contains the returned HTML, JSON, text, or other data when applicable.

Example HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json

{
  "id": 101,
  "name": "Amit",
  "department": "IT"
}

The response body contains JSON data representing an employee. A frontend application can parse the JSON and display the information.

7. Common HTTP Methods in Java Web Applications

HTTP methods have different semantics. For example, GET should be safe and should not be used to perform operations that change application data. PUT and DELETE are defined as idempotent methods, while POST is not generally idempotent.

8. Role of Java Servlets in Client-Server Architecture

A Java Servlet is a server-side component that processes requests and generates responses within a compatible servlet container. It provides Java applications with access to HTTP request information and response-writing functionality.

When a browser sends an HTTP request to a servlet mapping, the container creates request and response objects and invokes the appropriate servlet method.

Important Servlet Classes and Interfaces

• HttpServlet: Base class commonly extended to implement HTTP endpoints.
• HttpServletRequest: Provides access to request parameters, headers, paths, and other request information.
• HttpServletResponse: Allows the servlet to set response status, headers, content type, and response content.
• Servlet container: Manages servlet lifecycle and request processing.
• HttpSession: Supports server-side session data associated with a client session.

Servlet Request Flow

Browser
   |
   | GET /hello
   v
Servlet Container
   |
   | Maps URL to servlet
   v
HelloServlet
   |
   | Creates response
   v
HTTP Response
   |
   v
Browser Displays Result

9. Practical Example: Creating a Java Servlet

The following example demonstrates a simple client-server interaction using a Java Servlet. The client requests a welcome message, and the server returns a text response.

Java Servlet Code

import java.io.IOException;
import java.io.PrintWriter;
import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

@WebServlet("/hello")
public class HelloServlet extends HttpServlet {

    @Override
    protected void doGet(
            HttpServletRequest request,
            HttpServletResponse response)
            throws ServletException, IOException {

        response.setContentType("text/plain;charset=UTF-8");

        try (PrintWriter out = response.getWriter()) {
            out.println("Hello! Welcome to Java Web Applications.");
        }
    }
}

Explanation

• The @WebServlet("/hello") annotation maps the servlet to the /hello URL path.
• The doGet() method handles HTTP GET requests.
• The request object provides information about the incoming request.
• The response object defines the response content type and writes the result.
• The browser displays the returned message.

This example uses Jakarta Servlet imports and requires a compatible servlet container, such as a suitable version of Apache Tomcat, plus a correctly configured web application. Older Java EE applications may use javax.servlet packages instead.

How to Test

1. Create a web application project in an IDE.
2. Add the servlet API dependency using the appropriate build configuration.
3. Deploy the application to a compatible servlet container.
4. Start the server and identify the application's context path.
5. Open http://localhost:8080/your-app/hello in a browser, replacing your-app with the actual context path.
6. Verify that the welcome message appears.

10. Client-Server Communication Using HTML Forms

HTML forms allow users to submit information from a browser to a server. A Java web application can receive form data through a Servlet or a controller.

HTML Form Example

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Employee Form</title>
</head>
<body>
    <h2>Enter Employee Details</h2>

    <form action="employee" method="post">
        <label for="name">Employee Name:</label>
        <input type="text" id="name" name="employeeName"
               required>

        <button type="submit">Submit</button>
    </form>
</body>
</html>

Servlet to Process Form Data

import java.io.IOException;
import java.io.PrintWriter;
import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

@WebServlet("/employee")
public class EmployeeServlet extends HttpServlet {

    @Override
    protected void doPost(
            HttpServletRequest request,
            HttpServletResponse response)
            throws ServletException, IOException {

        request.setCharacterEncoding("UTF-8");

        String employeeName =
                request.getParameter("employeeName");

        response.setContentType("text/plain;charset=UTF-8");

        try (PrintWriter out = response.getWriter()) {
            if (employeeName == null ||
                    employeeName.isBlank()) {
                response.setStatus(
                    HttpServletResponse.SC_BAD_REQUEST);
                out.println("Employee name is required.");
                return;
            }

            out.println("Employee form received successfully.");
        }
    }
}

Explanation: The browser submits the form using POST. The servlet reads the form field using getParameter(), validates that it is present, and returns an appropriate message.

This demonstration does not save the employee in a database. A production application should also apply business validation, authorization, safe output handling, and any required CSRF protection before performing state-changing operations.

11. Two-Tier Architecture

Two-tier architecture divides an application into two main layers: the client and the data server. The client communicates directly with the database or data server.

Structure

+----------------------+
| Client Application   |
| UI + Some Logic      |
+----------+-----------+
           |
           v
+----------------------+
| Database Server      |
| MySQL / PostgreSQL   |
+----------------------+

Advantages

• Simple to understand and implement for small systems.
• Can be suitable for controlled internal applications.
• Requires fewer application layers.

Disadvantages

• Business logic may become tightly coupled to the client.
• Database credentials and permissions are harder to protect if clients connect directly.
• Scaling and centralized maintenance may become difficult.
• Not generally the preferred design for public-facing applications with sensitive data.

12. Three-Tier Architecture

Three-tier architecture separates the presentation layer, application layer, and data layer. This is a common design for Java web applications because it organizes user interaction, business logic, and data persistence into distinct responsibilities.

Three Main Tiers

1. Presentation tier: The browser or frontend displays information and collects user input.
2. Application tier: Java components validate requests, apply business rules, and coordinate operations.
3. Data tier: The database stores and retrieves application information.

Diagram

+----------------------------+
| Presentation Tier          |
| Browser / Frontend         |
+-------------+--------------+
              |
              v
+----------------------------+
| Application Tier           |
| Java Servlet / Spring Boot |
| Controllers and Services   |
+-------------+--------------+
              |
              v
+----------------------------+
| Data Tier                  |
| JDBC / JPA / Database      |
+----------------------------+

Advantages

• Separates presentation from business logic and data storage.
• Improves code organization and maintainability.
• Supports independent testing of application components.
• Allows the application layer to be scaled separately from the database.
• Provides a centralized location for security and business rules.

13. Multi-Tier Architecture

Multi-tier architecture extends the layered approach by dividing responsibilities into additional services or deployment components. A larger Java application may use an API gateway, authentication service, business services, caching layer, message broker, and multiple databases.

Example Structure

Client / Browser
       |
       v
Load Balancer / API Gateway
       |
       v
Java Web Application
       |
       +------ Authentication Service
       |
       +------ Business Service
       |
       +------ Cache
       |
       +------ Message Broker
       |
       v
Database Services

Not every application needs this level of complexity. Additional tiers introduce network communication, configuration, monitoring, and operational overhead. Choose architecture based on actual requirements rather than adding components unnecessarily.

14. Role of JDBC in Client-Server Architecture

JDBC stands for Java Database Connectivity. It provides Java applications with APIs for connecting to relational databases, executing SQL statements, retrieving results, and managing transactions.

Typical Database Request Flow

1. The client requests employee information.
2. The Java controller or servlet receives the request.
3. The service layer applies business rules.
4. The data access layer executes a database query through JDBC or another persistence technology.
5. The database returns matching records.
6. The application transforms the result into a response.
7. The client displays the returned data.

Example JDBC Query

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;

public class EmployeeRepository {

    public void findEmployee(int employeeId)
            throws SQLException {

        String url = "jdbc:mysql://localhost:3306/company";
        String user = "app_user";
        String password = System.getenv("DB_PASSWORD");

        String sql =
            "SELECT id, name FROM employees WHERE id = ?";

        try (Connection connection =
                 DriverManager.getConnection(
                     url, user, password);
             PreparedStatement statement =
                 connection.prepareStatement(sql)) {

            statement.setInt(1, employeeId);

            try (ResultSet resultSet =
                     statement.executeQuery()) {

                if (resultSet.next()) {
                    System.out.println(
                        resultSet.getInt("id"));
                    System.out.println(
                        resultSet.getString("name"));
                } else {
                    System.out.println(
                        "Employee not found.");
                }
            }
        }
    }
}

Explanation: The repository connects to the database, executes a parameterized query, and reads the result. The example assumes that the database, employees table, JDBC driver, and application credentials have been configured.

In a production application, avoid printing database details directly to users. Return structured results to the service layer, handle errors appropriately, and use a connection pool for efficient database access.

15. Session Management in Client-Server Applications

HTTP is stateless by default. This means each request is treated as an independent request unless the application uses mechanisms to associate requests with a session or other state.

For example, an online shopping application may need to remember a user's authenticated state and shopping cart while the user navigates between pages.

Common Session Management Techniques

• Cookies: Store small pieces of information in the browser, often including a session identifier.
• HttpSession: Stores session-related data on the server in servlet-based applications.
• Token-based authentication: Uses tokens to authenticate requests according to the application's security design.
• URL rewriting: Can carry session identifiers in URLs in certain servlet configurations, but must be considered carefully because URLs can leak through logs, browser history, and referrer information.

HttpSession Example

import java.io.IOException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;

@WebServlet("/session-demo")
public class SessionDemoServlet extends HttpServlet {

    @Override
    protected void doGet(
            HttpServletRequest request,
            HttpServletResponse response)
            throws IOException {

        HttpSession session = request.getSession();

        Integer visits =
            (Integer) session.getAttribute("visits");

        if (visits == null) {
            visits = 0;
        }

        visits++;
        session.setAttribute("visits", visits);

        response.setContentType("text/plain;charset=UTF-8");
        response.getWriter().println(
            "Visits in this session: " + visits);
    }
}

Each request associated with the same session increments the visit count. This example is for learning purposes and does not replace proper authentication or authorization.

Session Security Best Practices

• Use HTTPS throughout authenticated sessions.
• Use secure cookie settings such as HttpOnly and Secure where appropriate.
• Configure suitable SameSite cookie behavior.
• Regenerate the session identifier after authentication or privilege changes.
• Expire sessions after an appropriate period of inactivity.
• Never treat a session identifier as proof that the user is authorized to perform every action.

16. Advantages of Client-Server Architecture

• Centralized processing: Business rules can be maintained on the server.
• Data security: The database can remain behind a protected application layer instead of being directly exposed to clients.
• Maintainability: Backend logic can be updated centrally.
• Scalability: Servers and supporting infrastructure can be scaled according to workload.
• Resource sharing: Multiple clients can access common services and data.
• Cross-platform access: Different clients can communicate with the same backend through a documented protocol.
• Integration: Java services can communicate with databases and other applications.
• Testing: Business logic and API behavior can be tested independently from the user interface.

17. Disadvantages and Challenges

• Network dependency: Clients may be unable to access server services during network outages.
• Server bottlenecks: A server may become overloaded if resources are insufficient.
• Deployment complexity: Server configuration and release management require planning.
• Security risks: Exposed endpoints may be targeted by unauthorized users or automated attacks.
• Latency: Network requests introduce delays compared with local operations.
• Session complexity: Distributed deployments need suitable strategies for session storage and consistency.
• Database contention: Concurrent requests may compete for database resources.

These challenges can be addressed through monitoring, caching, connection pooling, load balancing, proper security controls, and appropriate application design.

18. Client-Server Security Best Practices

• Use HTTPS to protect data in transit.
• Validate every important input on the server.
• Use parameterized SQL queries to reduce SQL injection risks.
• Authenticate users and authorize every protected operation.
• Keep database credentials and API secrets out of source code.
• Use least-privilege permissions for database and service accounts.
• Protect state-changing requests against CSRF when the authentication design requires it.
• Encode untrusted data appropriately when rendering HTML.
• Apply rate limiting where appropriate to help prevent abuse.
• Return safe error messages without exposing stack traces or secrets to clients.
• Log security-relevant events while avoiding unnecessary sensitive information.
• Keep Java dependencies and server software updated.

19. Performance Optimization

A well-designed client-server application should use server resources efficiently and avoid unnecessary network communication.

Common Optimization Techniques

• Connection pooling: Reuse database connections instead of repeatedly creating physical connections.
• Caching: Cache suitable responses or frequently accessed data when correctness permits.
• Database indexing: Create appropriate indexes for frequently used query conditions.
• Pagination: Return manageable portions of large datasets.
• Efficient payloads: Return only the information needed by the client.
• Compression: Use supported HTTP compression when it benefits the workload.
• Asynchronous processing: Move suitable long-running tasks to background processing.
• Monitoring: Measure response times, error rates, resource utilization, and database query performance.
• Load balancing: Distribute traffic across application instances when the deployment requires it.

20. Common Errors and Troubleshooting

21. Mini Project: Employee Information Web Application

Project Objective: Create a Java web application in which users can retrieve and manage employee information through a browser.

Functional Requirements

• Display an employee registration form.
• Submit employee details to the server.
• Validate the submitted information.
• Save employee data in a relational database.
• Retrieve and display employee records.
• Update and delete records according to user permissions.
• Provide useful success and error responses.

Suggested Technology Stack

• HTML, CSS, and JavaScript for the client interface.
• Java Servlets or Spring Boot for request handling.
• JDBC or JPA for database access.
• MySQL or PostgreSQL for persistent storage.
• Apache Tomcat for a compatible servlet-based deployment.
• Maven for dependency management.
• Postman for API testing where REST endpoints are used.
• Git for version control.

Project Workflow

1. Design the user interface and form fields.
2. Define employee fields and create the database table.
3. Create the servlet or controller endpoint.
4. Validate incoming requests on the server.
5. Implement service and data access components.
6. Connect the application to the database.
7. Return an appropriate response after each operation.
8. Test valid input, invalid input, missing records, and database failures.
9. Apply authentication and authorization to sensitive operations.

22. Interview Questions and Answers

Q1. What is client-server architecture?

Answer: It is a model in which a client sends requests to a server, and the server processes them and returns responses.

Q2. What is the role of a client in a Java web application?

Answer: The client displays the interface, collects user input, sends HTTP requests, and processes the responses returned by the server.

Q3. What is the role of a Java server?

Answer: It handles incoming requests, validates information, executes business logic, communicates with data sources, and generates responses.

Q4. What is HTTP?

Answer: HTTP is an application-layer protocol used to exchange requests and responses between clients and servers.

Q5. What is the difference between HTTP and HTTPS?

Answer: HTTPS uses TLS to protect HTTP communication against eavesdropping and tampering when correctly configured. HTTP does not provide that transport encryption by itself.

Q6. What is a Servlet?

Answer: A Servlet is a server-side Java component that processes requests and creates responses within a servlet container.

Q7. What is the difference between two-tier and three-tier architecture?

Answer: Two-tier architecture typically connects a client directly to a data server, whereas three-tier architecture introduces an application layer between the presentation and data layers.

Q8. Why is JDBC used?

Answer: JDBC enables Java applications to execute SQL statements and interact with relational databases.

Q9. Why is HTTP described as stateless?

Answer: HTTP does not inherently retain application session state between requests. Applications can associate requests through mechanisms such as cookies and server-side sessions.

Q10. What is the purpose of HttpSession?

Answer: HttpSession allows a servlet-based application to associate server-side data with a user's session across multiple requests.

Q11. What is the difference between GET and POST?

Answer: GET is intended for retrieving a resource, while POST submits data to create a resource or initiate an operation. POST requests commonly carry form data or JSON in the request body.

Q12. How can Java web application performance be improved?

Answer: Performance can be improved through connection pooling, caching, efficient database queries, pagination, suitable concurrency management, monitoring, and load balancing when needed.

23. Practical Exercises and Quick Revision

Practice Exercises

1. Draw a client-server architecture diagram for an online shopping application.
2. Create a Servlet that returns a welcome message.
3. Build an HTML form that submits employee details using POST.
4. Write a servlet that validates incoming form data.
5. Connect a Java application to MySQL using JDBC.
6. Compare two-tier and three-tier architecture with examples.
7. Implement a session counter using HttpSession.
8. Test GET and POST endpoints using a browser or Postman.
9. Identify the causes of HTTP 404, 400, and 500 responses.
10. Add appropriate validation, authorization, and error handling to a mini project.

Quick Revision Checklist

• Client initiates a request; server processes it and returns a response.
• HTTP defines request and response messages.
• HTTPS protects communication through TLS.
• Servlets process HTTP requests inside a servlet container.
• JDBC provides database connectivity for Java applications.
• Three-tier architecture separates presentation, application, and data layers.
• HTTP is stateless by default; sessions can associate multiple requests.
• Validation and authorization must be performed on the server.
• Connection pooling and efficient queries can improve performance.
• Testing and logging help identify client-server communication failures.

24. Conclusion

Client-server architecture is a fundamental concept in Java web application development. It explains how browsers and other clients communicate with Java servers through HTTP requests and responses. Java Servlets, Spring MVC, and Spring Boot provide different approaches to handling requests, while JDBC and persistence frameworks allow applications to work with databases.

Understanding the responsibilities of each layer helps developers create applications that are maintainable, secure, testable, and scalable. Practical experience with forms, Servlets, database connectivity, sessions, REST APIs, and troubleshooting provides a strong foundation for advanced Java development.

To explore more Java web development concepts, visit the JustAcademy Advanced Java Training Course. You can also register for a course demo or visit the JustAcademy official website.