A web application is not required to container a web.xml....
In other words an application containing only static files or JSP page does not require a web.xml to be present.
Tim Holloway wrote:The web.xml file is necessary when:
1. Annotations have not been provided for one or more resources that must be defined in a web.xml context to be usable.
2. You wish to override an annotation value for one or more resources that must be defined in a web.xml context to be usable.
Functionally "web.xml" always exists, it's just that in olden days, you had to define it all manually and explicitly. Now it's possible for a "virtual" web.xml to be produced. This virtual web.xml is constructed by scanning the classes for web.xml-context annotations and building up equivalents. Then, if a physical web.xml exists, any entries not supplied from the annotation scan will be added and any entries that overlap annotations will override the annotation values. This is in accordance with the general practice regarding annotation specifications - class annotations are used unless overridden by an explicit outside source (usually an XML file). That reduces or eliminates the need for separate out-of-line definitions, since the XML file needs only to contain exceptions to the defaults (and any missing entries).
Incidentally, every J(2)EE web application has 2 "deployment descriptors" which define how the webapp is to be deployed and wired into the server (URL routing, resource definitions, etc.) There's a server-dependent deployment descriptor which defines server-specific characteristics. For example, a Tomcat webapp's server-dependent is its Context xml definition (which can be supplied externally, as part of a WAR, or automatically constructed from defaults). Other servers have other server-dependent deployment descriptor files and formats.
For characteristics that are not specific to a particular brand of server, there's the server-independent deployment descriptor. Which is the WEB-INF/web.xml file or an automatically constructed equivalent.
The order of the filters in the chain is the same as the order in which filter mappings appear in the web application deployment descriptor.