Page Comparison

public final ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response)
			throws Exception {

		// delegate to WebContentGenerator for checking and preparing
		checkAndPrepare(request, response, this instanceof LastModified);

		// execute in synchronized block if required
		if (this.synchronizeOnSession) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				synchronized (session) {
					return handleRequestInternal(request, response);
				}
			}
		}
		
		return handleRequestInternal(request, response);
	}

/**
 * Template method. Subclasses must implement this.
 * The contract is the same as for handleRequest.
 * @see #handleRequest
 */
 protected abstract ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response)
	    throws Exception;

/**
 * Handles two cases: form submissions and showing a new form.
 * Delegates the decision between the two to isFormSubmission,
 * always treating requests without existing form session attribute
 * as new form when using session form mode.
 */
 protected final ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response)
    throws Exception {
    if (isFormSubmission(request)) {
        if (isSessionForm() && request.getSession().getAttribute(getFormSessionAttributeName()) == null) {
            // cannot submit a session form if no form object is in the session
            return handleInvalidSubmit(request, response);
        }
        
        // process submit
        Object command = getCommand(request);
        ServletRequestDataBinder binder = bindAndValidate(request, command);
        return processFormSubmission(request, response, command, binder.getErrors());
    
   } else {
        return showNewForm(request, response);
   }
 }

The bindAndValidate() method is implemented in BaseCommandController as:

/**
	 * Bind the parameters of the given request to the given command object.
	 * @param request current HTTP request
	 * @param command the command to bind onto
	 * @return the ServletRequestDataBinder instance for additional custom validation
	 * @throws Exception in case of invalid state or arguments
	 */
	protected final ServletRequestDataBinder bindAndValidate(HttpServletRequest request, Object command)
			throws Exception {
		ServletRequestDataBinder binder = createBinder(request, command);
		binder.bind(request);
		onBind(request, command, binder.getErrors());
		if (this.validators != null && isValidateOnBinding() && !suppressValidation(request)) {
			for (int i = 0; i < this.validators.length; i++) {
				ValidationUtils.invokeValidator(this.validators[i], command, binder.getErrors());
			}
		}
		onBindAndValidate(request, command, binder.getErrors());
		return binder;
	}

That createBinder method it invokes looks like this:

protected ServletRequestDataBinder createBinder(HttpServletRequest request, Object command)
	    throws Exception {
		ServletRequestDataBinder binder = new ServletRequestDataBinder(command, getCommandName());
		if (this.messageCodesResolver != null) {
			binder.setMessageCodesResolver(this.messageCodesResolver);
		}
		initBinder(request, binder);
		return binder;
	}

The upshot of the matter is that setter methods for JavaBean properties the names of which correspond to the names of parameters on the HttpServletRequest are invoked with the values of those HttpServletRequest parameters as arguments.

protected abstract ModelAndView processFormSubmission(
			HttpServletRequest request,	HttpServletResponse response, Object command, BindException errors)
			throws Exception;

  public void afterPropertiesSet() throws Exception {

        if (this.getCommandClass() == null) {
            this.setCommandName("credentials");
            this.setCommandClass(UsernamePasswordCredentials.class);

/**
 * Retrieve a command object for the given request.
 * <p>Default implementation calls createCommand. Subclasses can override this.
 * @param request current HTTP request
 * @return object command to bind onto
 * @see #createCommand
 */
 protected Object getCommand(HttpServletRequest request) throws Exception {
    return createCommand();
 }

/**
 * Create a new command instance for the command class of this controller.
 * @return the new command instance
 * @throws InstantiationException if the command class could not be instantiated
 * @throws IllegalAccessException if the class or its constructor is not accessible
 */
 protected final Object createCommand() throws InstantiationException, IllegalAccessException {
    if (this.commandClass == null) {
         throw new IllegalStateException("Cannot create command without commandClass being set - " +
            "either set commandClass or override formBackingObject");
    }
    if (logger.isDebugEnabled()) {
        logger.debug("Creating new command of class [" + this.commandClass.getName() + "]");
    }
    return this.commandClass.newInstance();
 }