Page History

To make it clear "request processing" here means all actions which that take place within HttpServlet#doGet/doPost() or Filter#doFilter() method call. These is no single class in Wicket that does all the job. Classes delegate request processing to each other. In a simplified way it goes like this:
1.

1. browser requests a URL

...

1. WicketFilter/Servlet receives request from servlet container and creates RequestCycle object (it's created for every request)

...

1. RequestCycle processes request in several steps, using for this IRequestCycleProcessor

...

1. Depending on request parameters IRequestCycleProcessor creates IRequestTarget (in Wicket this process is referred to as "resolving")

...

1. IRequestTarget use existing Page or creates new one, optionally run callbacks (user code which handles link clicks, form submits, etc.), asks Page and Components to render

...

1. Page/Components render themselves what means to produce markup and write it to HttpResponse

...

1. servlet container writes output to browser

...

(optionally) execute code which somehow changes data (stored in http session, database or elsewhere)
output HTML page to HttpServletResponse (output may reflect data change)There are more classes involved in request processing. Below is short description of each of these classes. Descriptions say what is the purpose of the class, when it is created, how to get its instance(s). It's also a good idea to look at these classes' javadocs.

...

RequestCycle delegates most of request processing to IRequestCycleProcessor (see RequestCycle#step()). Besides that RequestCycle contains instances of WebRequest, WebResponse which basically wraps HttpServletRequest and HttpServletResponse adding Wicket related functionality. Instances of all these classes are created on every request.
This is a pseudo code of how RequestCycle is created:

...

You can customize creation of WebRequest, WebResponse and RequestCycle by overriding WebApplication#newWebRequest(), newWebResponse() or newRequestCycle().
To obtain RequestCycle instance you can call RequestCycle#get() which gets instance from ThreadLocal variable. You can get obtain WebRequest, WebResponse instances from WebRequestCycle calling getWebRequest(), getWebResponse() methods. To get HttpServletRequest/Response you can do something like this (this is not straightforward but you should not need to do it in Wicket):

...

There is one instance of IRequestCycleProcessor per Application. It is lazily created during the first request. Its creation can be customized by overriding WebApplication#newRequestCycleProcessor(). You can get its instance by WebApplication#getRequestCycleProcessor().

WebSession

IRequestTarget

IRequestTarget is responsible for calling event handling code (for example onSubmit() method) and asking pages and components to render. IRequestTarget is created by IRequestCycleProcessor on every request. Which subclass of IRequestTarget will be created depends on RequestParameters instance which is decoded from requested URL. For example if a bookmarkable page is requested BookmarkablePageRequestTarget will be created, if a link is pressed ListenerInterfaceRequestTarget will be created.
You can get current request target by calling RequestCycle#getRequestTarget().
See also Request targets pageWebSession holds information about a user session including some fixed number of most recent pages. WebSession roughly corresponds to HttpSession. It is lazily created during request handling. Then WebSession is stored in HttpSession and restored from there on next request. If HttpSession expires and WebSession in which is stored it can't be reached anymore new WebSession instance is created.
To customize Session creation you can override Application#newSession().
You can get instance of Session using Session#get() method.

...

There is one instance of IRequestCodingStrategy per IRequestCycleProcessor. It is usually WebRequestCodingStrategy which is lazily created during the first request. Its creation can be customized by overriding AbstractRequestCycleProcessor#newRequestCodingStrategy().
See also Request coding strategy page.

IRequestTarget

WebSession

WebSession holds information about a user session including some fixed number of most recent pages. WebSession roughly corresponds to HttpSession. It is lazily created during request handling. Then WebSession is stored in HttpSession and restored from there on next request. If HttpSession expires and WebSession in which is stored it can't be reached anymore new WebSession instance is created.
To customize Session creation you can override Application#newSession().
You can get instance of Session using Session#get() methodIRequestTarget is responsible for calling event handling code (for example onSubmit() method) and asking pages and components to render. IRequestTarget is created by IRequestCycleProcessor on every request. Which subclass of IRequestTarget will be created depends on RequestParameters instance which is decoded from requested URL. For example if a bookmarkable page is requested BookmarkablePageRequestTarget will be created, if a link is pressed ListenerInterfaceRequestTarget will be created.
You can get current request target by calling RequestCycle#getRequestTarget().
See also Request targets page.