There is a class with private fields. If you pass an object of this class to a JSP page, the JSP page will have access to the private fields of the object. Why it happens?
public class Main { private int value; private String str; public int getValue(){ return value; } public void setValue(int value) { this.value = value; } publi String getStr(){ return str; } public void setStr(String str) { this.str = str; } } // передаем объект jsp странице Main obj = new Obj(); obj.setValue(42); obj.setStr("42"); req.setAttribute("obj", obj); getServletContext().getRequestDispatcher("/jsp/page.jsp").forward(req, resp); // page.jsp <%@ page contentType="text/html;charset=UTF-8" language="java" %> <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %> <html> <head> <title>Title</title> </head> <body> <p><c:out value="${obj.value}"/></p> <p><c:out value="${obj.str}"/></p> </body> </html>