What is the best way to add authorization to the site?

Question

Java

At certain points, it is required to check authorization or register new users in an application using servlets and tomcat.
What is the best way to move the application logic into a separate class, taking into account multithreading and the need to communicate with the base?

• Make authorization static.
  
• Move authorization to a separate class. Create an object of this class in each servlet that requires authorization in the init () method. In turn, in this object, in the constructor, get a connection to the database, etc.
  

1. Which option is better and why?
2. Are there other options better than these, if so why? (when answering this point, you should not ignore the first one)
Note: I want to file authorization and registration myself, yes, I am aware that there are ready-made solutions.

Answer 1

It is best to entrust the authorization to the container as well.

Answer 2

If you need to do everything yourself, then you can implement your own filter (by implementing the javax.servlet.Filter interface ), in which you can try to understand whether the user is authorized or not. Such a filter must be written in web.xml in the form

<filter>
    <filter-name>requestInterceptor</filter-name>
    <filter-class>com.example.RequestInterceptorFilter</filter-class>
</filter>

Such a filter will intercept absolutely all http requests.

Answer 3

It is written above, if you want a wider use of authorization, then you can also look at
https://shiro.apache.org/