The following are some of the best practices that must be considered while designing and developing a web application:

• Spring MVC is the best choice to design and develop a web application because of the Spring DI pattern and the very flexible MVC pattern with Spring. Spring's DispatcherServlet, too, is very flexible and customizable.
• In any web application using the MVC pattern, the front controller should be generic and as lightweight as possible.
• It is important to maintain a clear separation of concerns across the layers of the web application. Separating layers improves the clean design of the application.
• If an application layer has too many dependencies with the other layers, as a best approach, introduce another layer to reduce the dependency of that layer.
• Never inject a DAO object to the controllers in the web application; always inject a services object to the controller. The DAO objects must be injected with the service layers so that the service layer talks to the data access layer, and the presentation layer talks to the service layer.
• Application layers such service, DAO, and presentation layers must be pluggable, and must not be bound with the implementation, that is, using interfaces reduces the actual coupling to concrete implementations, as we know that loosely coupled layered applications are easier to test and maintain.
• It is strongly recommended to place JSP files in the WEB-INF directory, because this location is not accessed by any client.
• Always specify the name of the command object in the JSP file.
• JSP files must not have any business logic and business processing. For such a requirement, we strongly recommend the use of View helper classes such as tags, libraries, JSTL, and so on.
• Remove the programming logic from template-based views like JSP.
• Create reusable components that can be used to combine model data across views.
• Each component of the MVC pattern must have a consistent behavior for which the MVC introduced it. This means that the controller should follow the Single Responsibility Principle. Controllers are responsible only for delegating business logic invocation and view selection.
• Finally, be consistent with naming of the configuration files. For example, web beans such as controllers, interceptors, and view resolvers must be defined in separate configuration files. Other application beans such as services, repositories, and so on must be defined into another, separate file. Similarly for security concerns.