JSP implicit objects expose the current request, response, output writer, configured scopes, page context, Servlet configuration, application context, and exception state. Use the narrowest correct scope and keep request handling in a controller.
request is the HttpServletRequest for the current call. It provides parameters, headers, attributes, locale, cookies, method, and path information. Parameters are untrusted client strings; attributes are server-side values placed on the request by filters, controllers, or forwards.
response controls status, headers, cookies, redirects, and the response body. out is the buffered JspWriter used by generated template output. Avoid mixing manual binary output with JSP rendering, and do not redirect after the response is committed.
pageContext can read and write all JSP scopes and provides access to request, response, Servlet context, forwarding, and including. pageScope lasts for one JSP evaluation; requestScope lasts for one request and forwards; sessionScope lasts across requests in one session; applicationScope is shared by the web application.
Use request scope for ordinary view models. Use session only for state that truly spans requests, such as a small authenticated-user identifier or a multi-step flow. Application scope is shared across users and threads, so mutable values need safe concurrency and lifecycle management.
config is the ServletConfig for the generated JSP Servlet, and application is the ServletContext shared by the deployed application. page refers to the generated Servlet instance and is rarely useful in a view. Prefer application configuration and dependency injection in Java code rather than reading infrastructure settings throughout JSP files.
The exception object exists only on a page configured as an error page. Even there, render a safe message and correlation identifier rather than stack traces, SQL details, paths, or secrets.
EL offers pageScope, requestScope, sessionScope, applicationScope, param, paramValues, header, headerValues, cookie, and initParam maps. param returns one value; paramValues preserves repeated values. Explicit scope names prevent accidental shadowing when a request and session both contain user.
Implicit access does not remove validation or authorization. A request parameter may be missing, repeated, malformed, or malicious. Validate in the controller and expose a typed, authorized view model instead of using raw parameters to select records in the JSP.
<%@ taglib prefix="c" uri="jakarta.tags.core" %>
<p>Request ID: <c:out value="${requestScope.requestId}" /></p>
<p>User: <c:out value="${sessionScope.currentUser.displayName}" /></p>
<p>Search: <c:out value="${param.q}" /></p>
<c:if test="${not empty cookie.theme}">
<p>Theme cookie is present.</p>
</c:if>Explicit scope avoids ambiguity when request and session contain the same attribute name.
<p>Request message: ${requestScope.message}</p>
<p>Signed-in user: ${sessionScope.user.displayName}</p>
<p>Request method: ${pageContext.request.method}</p>Values are read from the named scope without scriptlets.A parameter comes from the client request. An attribute is a server-side object attached during request processing and is commonly used to pass a view model to JSP.
No. Application scope is shared by every user. A cart belongs to a user or account and needs an appropriately isolated store.
Explore 500+ free tutorials across 20+ languages and frameworks.