Servlet Spec 4.0: does it mean I have to set web-app version = "4.0" in the web.xml file?
Yes.
JSP Spec 2.3: what should I set?
Nothing. JSP version goes hand in hand with Servlet version. So web.xml of 4.0 is fine to activate JSP 2.3.
<?xml version="1.0" encoding="UTF-8"?>
<web-app
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
version="4.0"
>
<!-- Config here. -->
</web-app>
EL 3.0 specification: does that mean I have to set faces-config version = "3.0" in the faces-config.xml file?
Absolutely not. EL is not JSF. EL version also goes hand in hand with Servlet version. So web.xml of 4.0 is fine to activate EL 3.0.
The faces-config.xml version indicates JSF version. But Tomcat does not ship with JSF out the box at all. You have to install it manually. Currently available latest JSF version is 2.3, so you have to set faces-config.xml to 2.3.
<?xml version="1.0" encoding="UTF-8"?>
<faces-config
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_3.xsd"
version="2.3"
>
<!-- Config here. -->
</faces-config>
Note that Tomcat also doesn't ship with JSTL and CDI out the box while they are also required by JSF. So you also have to manually install them both. Or, better, just pick a normal JEE server instead of a barebones servletcontainer. Then you don't need to manually install individual JEE artifacts not supported by the target servletcontainer.
See also:
