in order to decouple, I learned that servlet is required to be separated from Service (jsp/servlet presentation layer; service business logic layer; Dao persistence layer), but I feel very uncomfortable when writing practical exercises for small projects, such as:
users should inject successful login msg, into the request domain after they have successfully logged in.

request.setAttribute("msg","");

because there will be

${requestScope.msg}

but shouldn"t this be part of business logic? And the Service layer should not get request this thing, can only be given to servlet to complete it?
if this ultimately affects the jsp layer, that is, the presentation layer, so you can leave it to servlet to handle, okay. Well, now I am in a situation where members of the website have different permissions. After logging in successfully, I want to inject the user"s permission information into session

request.getSession.setAttribute("authority","admin");

this should be a matter for the business logic layer, isn"t it? But theoretically, if the Service layer cannot accept request objects, it should not be able to accomplish this task.
and if you leave it to Servlet, the login method returns a User object, and then gets the User object in Servlet, gets its authority attribute value, and injects it into session. No matter how I think about it, I think it"s business logic! How can you let Servlet handle it!
has a big head. I hope there are seniors who can answer it. Thank you!