Here’s a view of the lifecycle:
Yes, they’re shared by threads/requests; you should write them to be thread-safe. They should be stateless. Usually they have a reference to a Spring service that does all the work. Controllers handle binding, validation, and routing for the web tier.