Most of us use Spring Boot every day.
We create a @RestController, run the application, hit an endpoint from Postman, and get a response.
But have you ever wondered what actually happens between clicking “Send” in Postman and your controller method executing?
When I started digging into Spring internals, I realized there are several layers working together before my controller is even called.
Here’s the high-level request flow:
Postman
│
▼
Operating System
│
▼
Embedded Tomcat
│
▼
Servlet Filter Chain
│
▼
Spring Security (JWT)
│
▼
DispatcherServlet
│
▼
Controller
│
▼
Service
│
▼
Repository
│
▼
Database
What surprised me?
One thing I misunderstood for a long time was thinking that the request directly reaches my controller.
In reality:
The Operating System first routes the request to the application listening on the target port (for example, 8080).
Embedded Tomcat accepts the connection.
The request passes through the Servlet Filter Chain.
Spring Security validates the JWT (if security is enabled).
Only after successful authentication does the request reach Spring MVC’s DispatcherServlet, which finds the correct controller.
This means your controller only executes after several infrastructure components have already processed the request.
Key Takeaway
Understanding this request flow makes Spring Boot feel much less “magical.”
Instead of memorizing annotations, you begin to understand why they work.
In the next post, I’ll explain how Spring Boot starts Embedded Tomcat automatically before the first request even arrives.
