Test legacy JSP code in layers: compile and run it in the same Java and servlet/JSP container as production, exercise its sessions, filters, authentication and integrations, then verify critical user journeys in a browser. Add security checks and compare a clean baseline with the target container before upgrading Tomcat or Java. This approach finds JSP-specific failures without requiring an application rewrite.
Start with an inventory and a production baseline
A JSP page depends on more than its own source: its behavior can depend on the servlet container, Java runtime, tag libraries, filters, deployment descriptors, session state, databases and external services. Before changing code or infrastructure, record the deployed environment and map those dependencies.
- List JSPs, tag files, servlets, filters, listeners, tag libraries, JSTL usage and deployment descriptors.
- Record Java and Tomcat versions, JSP/Servlet level, connector settings, JVM flags and deployed libraries.
- Map database connections, authentication paths, scheduled jobs and external services.
- Choose representative HTTP requests and preserve important user journeys, including their expected status codes, redirects and visible outcomes.
Run the initial suite on the currently deployed Java and Tomcat versions. Save results that can be compared later: compilation output, responses, logs and browser-visible behavior. Use deterministic fixtures where possible so a changed result points to an application or environment change rather than shifting test data.
Choose the right test layer for each failure
No one test type establishes that a legacy JSP application is safe to change. Unit tests help isolate Java logic; container tests expose JSP compilation and runtime wiring; browser tests cover what users see; security tests target misuse cases that ordinary regression checks can miss.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Approach | Best at finding | What it cannot establish alone | Trade-off |
|---|---|---|---|
| Unit tests | Fast, diagnostic failures in isolated Java logic. | That a JSP compiles, renders, or is wired correctly in the container. | Fast to run; limited production fidelity for JSP behavior. |
| Container integration tests | JSP compilation, runtime wiring, sessions, filters, tag libraries, and application integrations. | That a complete user journey behaves correctly in a real browser. | Higher container fidelity; failures may involve several interacting components. |
| Browser regression tests | User-visible workflow and rendered-page changes. | Every internal branch or security abuse case. | Broader user coverage, but slower and more maintenance-sensitive. |
| Security tests | Authorization gaps, unsafe input handling, session weaknesses and exposed artifacts. | General functional correctness. | Targets abuse cases that ordinary regression tests rarely exercise. |
Use each layer for the evidence it can provide. In particular, a passing unit test is not a substitute for requesting JSPs from a production-like servlet/JSP container.
Test compilation and runtime behavior in a container
Run integration tests in the production-like container and on the Java baseline used in production. Include both a clean rebuild and first-request compilation: these catch failures that can be hidden by stale generated JSP classes or a previously populated work directory. If the build produces precompiled JSP artifacts, test that deployment path too.
Rank #2
Tomcat compatibility is version-specific. The Tomcat 9 migration guide documents support for Servlet 4.0, JavaServer Pages 2.3 and Expression Language 3.0. It also describes a JSP compilation breakage case in which a wildcard import conflicts with a newly implicit servlet class such as PushBuilder; explicit imports resolve that class-name collision. The Tomcat 8 migration guide records JSP 2.3 and EL 3.0 behavior, jar-scanning changes, and possible performance effects when EL resolves undefined identifiers. A page that worked on one container should therefore be tested on both the current and intended target rather than assumed compatible.
For Tomcat-specific diagnosis, the Tomcat 9 documentation index organizes relevant material around Jasper/JSP compiler configuration, class loading, deployment and security.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCompilation and JSP language features
- Compile every reachable JSP on a clean deployment, including pages reached through includes, forwards or less-frequent workflows.
- Exercise tag files, custom tag libraries, JSTL and Expression Language (EL) expressions with representative data, including missing or undefined values where the application encounters them.
- Check implicit and explicit imports, especially wildcard imports that may collide with container-provided classes.
- Verify character encoding, locale-sensitive output, date and number formatting, and escaping of dynamic values.
Request routing and application wiring
- Exercise includes, forwards, redirects, configured error pages and welcome-file routing.
- Check filter order, listener startup, session creation and authentication boundaries with both allowed and denied requests.
- Verify application-class and JAR visibility through the container class loader.
- Cover database transactions, connection failures, timeouts and retry behavior; a happy-path query alone does not exercise these boundaries.
Build integration tests around real dependencies and boundaries
Container tests should make the deployment behave like the system that will run in production. Use real session and authentication flows and a database when practical; where a faithful test double is necessary, make its failure behavior explicit. Include requests that cross filters and reach protected pages directly, not just through the expected navigation path.
For each critical request, assert the outcome that matters: status code, redirect destination, session state, rendered message, or resulting database change. When a request fails, inspect container logs for JSP compilation warnings, deprecations, reflection failures and changed status codes. Keep assertions focused enough to distinguish a broken JSP from a failed database connection or an authentication setup problem.
Rank #4
Automate a small set of browser regressions
Browser tests verify that the application still works as a user experiences it, including rendered output and client-side interaction. Prioritize journeys with real operational value rather than trying to drive every JSP through a browser.
Prioritize critical journeys
- Sign-in, sign-out and permission-sensitive navigation.
- Search, pagination and create/edit forms, including validation failures.
- Uploads and report generation, including downloaded-file properties.
Use deterministic fixtures and stable selectors rather than layout-dependent selectors. Assert a small set of meaningful results: response or redirect behavior, key headings, validation messages, and whether conditional content appears for the right user. A few targeted rendered-page checks can catch markup, encoding and conditional-display regressions without treating every whitespace change as a failure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
For a JUnit 5 suite, Selenium-Jupiter is one option: its 2024 paper describes a JUnit 5 extension for Selenium WebDriver and Docker support for running browsers in containers, which can help make CI runs repeatable. See the Selenium-Jupiter paper.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test security paths that functional checks miss
Use the OWASP Web Security Testing Guide (WSTG) as a structure for web-application security checks. The guide’s repository assigns scenarios identifiers in the form WSTG-<category>-<number>, which makes it practical to record exactly which scenarios the team has exercised; see the OWASP WSTG repository.
- Test authentication, authorization, and horizontal and vertical privilege boundaries, including direct requests to protected JSPs.
- Check session fixation risk, timeout, logout invalidation, cookie flags and CSRF defenses.
- Exercise input validation and output encoding across scriptlets, EL, tag libraries and form handlers.
- Where the application has the relevant features, test SQL injection, command injection, path traversal and unsafe upload paths.
- Inspect error pages, response headers, stack traces and debug flags for information that should not be exposed.
- Request unlinked JSPs, admin paths, old endpoints, backup files and temporary artifacts directly.
That last check matters for JSP applications: OWASP’s archived Testing Guide v2 warns that old or backup files can disclose server-side source code, including files associated with JSP-based applications.
Use a controlled checklist for Tomcat or Java upgrades
Treat an upgrade as a compatibility change, not just a server replacement. Keep a supported-version matrix that names the application’s tested Java and Tomcat combinations, and compare results against the current-production baseline before promoting a new combination.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Record current Java and Tomcat versions, JSP/Servlet level, connector settings, JVM flags and deployed libraries.
- Freeze baseline HTTP responses and browser journeys on the current production-like setup.
- Deploy to a clean target container and run JSP compilation, including any precompiled-artifact path.
- Compare current and target behavior for imports, EL, jar scanning, class loading, filter ordering and welcome-file routing.
- Run integration tests against session, database and authentication dependencies, or explicitly modeled faithful test doubles.
- Run browser regressions in CI across the browser set the application supports.
- Execute the security checks, including direct requests for old and backup JSP artifacts.
- Review logs for compilation warnings, deprecations, reflection failures and changed status codes; investigate each difference against the baseline.
- Promote only after differences are understood and either corrected or explicitly accepted.
This checklist is not a recommendation to move to a particular Tomcat release. Select a target that the application can support, then test that exact container and Java combination; migration behavior and supported levels vary by version.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
