Develop Reference

What template engine should I use in Spring MVC?

I'm learning Spring MVC and want to create a site. The main problem is a template system. Should I use JSP / JSF / Apache FreeMarker / Thymeleaf or something else?
I saw a lot of discussion on this subject, but they are all outdated. So, I'm curious, what is fine now?

The best practices for server-side rendering have shifted towards using a template engine. These get the responsibility to merge the data with the template into the actual output.
Current preferences appear to be:
Thymeleaf
FreeMarker
JSP's and JSF are entirely different things and have become out of fashion.
The big plus for using an actual template engine is that you are forced to separate the concerns of gathering the data to present and rendering it; this separation allows you to (unit) test the templates.
Note, however, that the industry is shifting once more towards client-side rendering, where the server just returns the data as JSON-objects and the web application uses some framework like Angular, React, jQuery or Ember to build the pages.
Note on the edit: Originally the list included Velocity, but that is no longer supported by Spring.

You can use any of them as they are supported. JSP, FreeMaker and Thymeleaf are similar by idea: you create a template to be rendered. JSP and FreeMaker lacks some features that are available in Thymeleaf.
I like Thymeleaf's idea where you can load your template to the browser and see how the page is going to be rendered (real). Thymeleaf template is fully featured HTML page. That's not possible in JSP where you have JSP tags and FreeMaker where you have placeholders.
JSF is component based so that's a different approach.
If I have to choose I would use Thymeleaf.

There are many template engines available out there. But Spring Boot officially supports Thymeleaf, FreeMarker, Mustache and Groovy Templates. My preference is Thymeleaf because of its extendability.
There is a detailed comparison on various aspects of template engines explained in the below post.
https://springhow.com/spring-boot-template-engines-comparison/

Programmatically Display a web page from a Servlet class

I'm really new to JSP and Servlets and all that jazz, and I'm confused about how to approach it.
Right now my main confusion is as follows:
It seems there are two ways to get a web page to display on the screen in a Java EE/JSP project:
Create an HTML page with the extension .jsp and in the web.xml file, map it to a url pattern (let's assume just /)
Create a Java class that extends Servlet, override the doGET() method to return a string of HTML code and map to this Java class in the web.xml.
My JSP project requires a decent amount of Java code to perform logic and login/logout operations. I've read that it's bad practice to inlcude Java code inside JSP pages as it becomes impossible to reuse, hard to keep track of, messy etc. I want to include much of code in Java, which will feel much more natural for me.
How should I build my project (assuming it's a simple beginner project in which I want to employ the best practices for organization, testing etc in preparation for building a larger project)? How can cleanly deploy web pages from inside Java classes, rather than having many JSP pages containing bits of Java code?

The pattern I've used in the past is to:
1) Write the servlet to perform whatever logic is necessary and to construct a reasonable number of serializable java objects to hold all of the data you want to be rendered via HTML.
2) The servlet stores those objects into the HTTP request and forwards the request and response objects to a JSP:
request.getRequestDispatcher("/some.jsp").forward(request, response);
3) The JSP can access the java objects in the request and merge the data with the static HTML to complete the request.

This is exactly the problem MVC pattern solves.
You do all your complex logic in the Controller (simple Java class, or a Servlet), then pass the data to View (JSP, Velocity, Freemarker, anything that can process the data and make a HTML).
There are several implementations of MVC for Java most popular being Spring MVC and Struts. Alternatively, you can just use your servlet for all your logic and then manually forward the request to a JSP for processing:
request.getRequestDispatcher("/index.jsp").forward(request,response);

If your are looking for best practices in clean separation of java code from the presentation, you might as well use a MVC Framework (Spring MVC or Struts are well know examples) that will help you to cleanly separate :
view layer (JSP)
controller layer
service layer
domain objects
persistence layer
It may be hard to begin with, but you will find nice tutorials through official sites and google.
If you want to only use servlets and JSP, the common rule is to have all logic and Java code in servlets, and that those servlets simply forward to JSP pages that will do the view part. The communication between then is done with request attributes (and of course, session and application context attributes.
Good luck ...

To manage bit of java code, you can use Scriptlet.
Also mentioned in other answers, you can use jsp:forward or response.sendRedirect
to call web pages.
Also see What is the difference between jsp:forward and response.sendRedirect

I'm not sure where you heard that its bad practice to include Java code in the HTML(JSP) files but in order to have a dynamically data driven website, Java is what you would use in the HTML(JSP). Keep in mind, all of your front end design will be in the HTML using JSP, and all of the your logic for handling requests and redirectors and passing data will be managed in the servlets using Java.
Your servlets can pass data, whether it be from a database or other data source, to the front end and your JSP will just help in displaying that data. It's called JSP for a reason. You can write Java in it.
The best approach for designing websites in Java is to use the MVC pattern that way it helps seperate all of the core functions of the site and can easily be scaled and managed.
Do you have any code that you have to show what you have done so far?

Velocity vs Apache Tiles

What's better?
We are going to start a new web project and it's a question which technology to choose.
Project includes Spring MVC + WebFlow.
Any good/bad experience in support, extending, performance?
Thank you.

Velocity and Tiles are two different beasts — Tiles is a layout engine and Velocity is a template engine. They do not intersect anywhere in terms of functionality.
From your question I can guess you probably won't be using JSP. That's a smart move. Velocity is one of the template engines out there and it does an absolutely splendid job.
And if you choose to follow the template engine route for your view, then check out commentit. It's a small, simple and fast layout engine I created. It might serve your purpose perfectly.

How do you want compare Tiles with Velocity? - Tiles is a way to compose page fragments, while Veleocity is a more complete template engine, better comparable with JSP than Tiles.
Anyway: I used Spring MVC with Tiles and JSP: It worked greatly, saved a lot of time (toward just using JSP, or JSP with Sitemash), and I did not noticed any performance problems. (But the web application was never used under high load.)

Use Tiles if you have some seperate HTML files that you want to bring together in a Template (i.e. you have a seperate page for a Header, Footer, Sidebar and you want to bring them together and display them in a sort of Newspaper-like format).
Use Velocity if you want to bring dynamic content across from a Java backend and inject those values into a full HTML page (i.e. you have a HTML table to display a selection of Cars, and all of your cars are stored in a Database. Using JPA, you could get that Car data out of the database, and into a List<Car> maintained in an EJB Bean, Spring #Component, or similar. Then, using Velocity, you can store that information as the bucket item inside a Map, and use the VTL mark-up to refer to the key value items in the Map so that they can be rendered as part of the HTML response.
To achieve the above, Velocity positions itself as an outright Front Controller Servlet, or is wrapped by another MVC framework (i.e. Spring MVC provides a View Resolver which wraps the functionality provided by a Velocity Servlet).
HTML requests are directed to the Velocity Servlet or alternative MVC Framework Servlet via web.xml configuration. As part of the servlet response, your pre-baked HTML view, complete with Velocity VTL mark-up, is enriched with Map data.
Effectively, and in summary:
Velocity competes in the same space as JSP.
Tiles is more akin to page transclusion. In the PHP space, Smarty is a popular cousin.
You don't choose between them, but very well could use both.

There is a Velocity plugin for Tiles 2.2 so you can use both - with velocity you will access context and build your bricks dynamically like with JSP and tiles will combine your website bricks together. However Tiles is not allowing to do many thigns (at least I haven't discovered them yet) and its documentation is very old and bad compared to for example Spring or JSF one. So you can consider using different technology instead.
I have Tiles references in my currect project because Roo did it for me but right now I'm moving everything to JSF.

Use both. Tiles and Velocity integrate very well and solve different problems. You can do some Tiles-ish stuff with Velocity's #include and #parse directives, but Tiles does that composition stuff better.

Can a freemarker viewpage be 'user' editable and secured?

If I let anyone modify a freemarker viewpage, can I somehow make it hack free?
I know I read somewhere that I can make disable scriplets, but that was for .jsp pages so not sure if it will work with freemarker.
I basically want a way where I can set the attributes that will be available on the page, and let web designers go into the page and edit it all they want (all the while making it secure).
i.e. I don't want people to be able to access any of objects in the request pipeline, or output my connection string to the page etc.

Request and other objects are exposed to the FreeMarker template by Spring's FreeMarkerView, when FreeMarker is used as a Spring MVC view technology.
To have a full control over the data being exposed to the templates, you can use FreeMarker directly, as described in the FreeMarker docs. However, you can still use Spring's support for FreeMarker configuration (FreeMarkerConfigurationFactoryBean).

Structure JSP/Java code where logic is not in the JSP file

This is a design question and good practice question. How do you structure your Java web development such that a lot of logic is not in the JSP file. Should you use any of the JSP tags for if structures or loops. I see a lot of code where the logic is hard to follow because of poorly designed JSP files. And then when you want to output to a different format like a PDF or XML document, you can't do it because all the logic is in the JSP file.
Are there any tips or practices that you follow for Java Web development.
I am currently using a combination of Spring, Hibernate, Struts...and work with some Servlet code.
There are good practices associated with Java development. Many of us that have worked a while know them. What are some good practices for JSP development.

The easiest way to avoid placing logic in JSPs is simply to perform all that logic before forwarding a request to a JSP. The only logic you should need to do in a JSP is some basic looping (e.g. for creating HTML table rows), evaluating conditional statements, and data formatting.
All of this can be done without using scriptlet code (Java code) in the JSPs by using JSP tag libraries and EL. The most important tag library is JSTL. The JSTL tag library provides most of the logic you should ever need to perform in a view, though you may occasionally also use niche 3rd party tag libraries like displaytag which can reduce the amount of JSP code you need to write for specific tasks.

Since you're already using Spring you may want to check out Spring Webflow. I assume you're using Spring form tags, but if not, you should check those out as well. With this combination there should be very little need [if any] to use JSP tags in your view logic.