JSON-B (JSON Binding) or Jackson, when integrated with JAX-RS, is the standard and maintainable approach. Annotations like @JsonbProperty (for naming) and @JsonbTransient (for exclusion) allow declarative control over the JSON output without writing low-level serialization code, aligning with Java EE’s convention-over-configuration philosophy.

By default, Singleton session beans use container-managed concurrency with a write lock (@Lock(LockType.WRITE)) on all business methods. This serializes access, making it thread-safe but a major performance bottleneck for a frequently accessed cache. The solution is to use fine-grained @Lock annotations, applying READ locks to getter methods and WRITE locks only to methods that modify the cache.

In EJB, by default, a container rolls back a transaction only when a runtime exception (unchecked) is thrown. Checked exceptions like SQLException do not automatically cause a rollback. To ensure the message is redelivered on database failure, the MDB must catch the SQLException and either throw a runtime exception or call `setRollbackOnly()` on the EJBContext.

The core distinction is the event source. Asynchronous session bean methods are triggered by a direct Java method call within the application and are managed within the EJB container. MDBs are event-driven components that react to the arrival of messages from an external messaging middleware (e.g., JMS, Kafka), providing loose coupling and integration with heterogeneous systems.

@RolesAllowed enforces authorization (what you are allowed to do) but does not itself trigger authentication (who you are). A 403 Forbidden indicates the server recognized the request but refuses to authorize it, often because the user is ‘anonymous’. To fix this, you must first ensure the user is authenticated by configuring a login method (e.g., FORM, BASIC) via a in web.xml or by using the @ServletSecurity annotation, which then provides a principal for role evaluation.

Producer methods (annotated with @Produces) extend CDI’s ability to inject objects that are not themselves CDI beans. They allow the container to manage the lifecycle and injection of resources like JPA EntityManager, JDBC DataSource, or custom objects whose instantiation requires complex logic (e.g., based on configuration). @Inject is used to request an instance, while @Produces is used to define how that instance is created.

The legacy JSF-managed bean scopes (from javax.faces.bean) are not integrated with CDI and can lead to lifecycle management issues. The CDI @SessionScoped annotation (javax.enterprise.context) ensures the bean is properly destroyed and eligible for garbage collection when the HTTP session is invalidated (e.g., on logout or timeout). This is a standard modernization step in Java EE applications.

The standard JPA optimization for bulk operations is to batch changes. This involves calling `em.flush()` to synchronize a batch of persisted entities with the database, followed by `em.clear()` to detach all managed entities from the persistence context. This prevents the context from growing uncontrollably (memory issue) and allows the JDBC driver to potentially batch the SQL statements, dramatically improving performance. This is often combined with a suitable batch size configuration.

The `persistence.xml` file is the required configuration file for JPA. It defines one or more persistence units. Each unit specifies the transactional data source (via JNDI name), the list of managed entity classes, and various settings like the persistence provider (e.g., Hibernate, EclipseLink) and its properties. It must be located in the `META-INF` directory of the deployment unit (EJB JAR or the WAR if entities are packaged there).

JSON-B (JSON Binding) or Jackson, when integrated with JAX-RS, is the standard and maintainable approach. Annotations like @JsonbProperty (for naming) and @JsonbTransient (for exclusion) allow declarative control over the JSON output without writing low-level serialization code, aligning with Java EE’s convention-over-configuration philosophy.0