The elements still holding back web.xml

While both JavaEE and Spring would like you to believe that you no longer need a web.xml file in your projects, that is not true. Here are a couple elements/configurations that are simply not available through Java Configuration.

1. Session-Timeout

<session-config>    
      <session-timeout>120</session-timeout>  
</session-config>

Yes, there is no way to specify a session-timeout using Java configuration.

Related Spring Bug: https://jira.spring.io/browse/SPR-11585

2. Execution order of filters

<filter-mapping>  
    <filter-name>filter1</filter-name>
    <url-pattern>/url1/*</url-pattern>  
</filter-mapping>  
<filter-mapping>  
    <filter-name>filter2</filter-name>
    <url-pattern>/url2/*</url-pattern>  
</filter-mapping>

There is no way to guarantee which order your filters execute in unless you specify them in a web.xml file. This can have dire security consequences with your authentication filter being executed after some security sensitive filter or being skipped entirely due to some previous filter in the chain.

Related Spring Bug: https://jira.spring.io/browse/SPR-12019

Vote for bugs
I dont know where to file a bug for JavaEE, but I have linked to the corresponding bugs for Spring and hopefully they will be fixed in the next release so we can actually get rid of the dreaded web.xml file.