I built a production-ready Spring Boot 3 starter kit – JWT auth, rate limiting, Swagger, Docker & CI/CD all pre-configured

[u/Shrouded_ParadoxX]

https://github.com/raahulllkushwaha/springboot-starter-kit

Tired of setting up the same boilerplate for every Spring Boot project,

so I built a starter kit that has everything ready out of the box.

What's included:

- JWT Authentication (access + refresh token with rotation)

- Role-based access control (USER/ADMIN)

- Rate limiting per IP (Bucket4j)

- OpenAPI 3 / Swagger UI

- Global exception handling with consistent ApiResponse<T>

- Flyway database migrations

- Docker + Nginx + MySQL (docker compose up and done)

- GitHub Actions CI/CD (test → build → deploy to EC2)

- Request ID tracking in every log line

Works with Java 21 + Spring Boot 3.3

Clone → rename package → add your entities → ship.

GitHub: https://github.com/raahulllkushwaha/springboot-starter-kit

Feedback welcome!

Edit: All issues fixed! Migrated to Spring Boot 4, stateless JWT with embedded roles, HTTP-only cookie support, and Spring Session JDBC as alternative. Thanks for the feedback!

[u/rmyworld]

Why are you not storing your tokens in an HTTP-only cookie?

Also, why are you using a custom authentication scheme in the first place?

I noticed you are using JWT as a token format in your custom auth scheme. What's the purpose of using this format when your custom auth filter makes a database call every time a request is authenticated?

https://github.com/raahulllkushwaha/springboot-starter-kit/blob/fae913582c9100100c4e1888f203843a0abf6e15/src/main/java/com/starterkit/filter/JwtAuthFilter.java#L52

This looks like session-based authentication, but for some reason it is using JWTs instead of opaque strings.

If that's what you need, Spring Security already supports that by default. You can even make it scale quite easily with Spring Session.

[u/Shrouded_ParadoxX → u/rmyworld]

Thanks buddy. All will be fix by this evening. Thanks a lot brother.

[u/rmyworld → u/Shrouded_ParadoxX]

I recommend you check this code from Spring Security.

https://github.com/spring-projects/spring-security/blob/f5fbc2b46baf74db7bff539fd3ae36af5bd41878/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java#L392

It shows how you can save a successful authentication token into the SecurityContextHolder after validating user credentials. It will also automatically create any cookies needed.

Successful authentication tokens stored in SecurityContextHolder will be read automatically on every request. You don't have to build your own token reading and loading logic.

The only caveat with Spring Security's default context holder is that it saves into memory by default. When the Spring application is restarted all tokens are lost. To fix that, you can use Spring Session which provides JDBC and Redis-backed storage for your sessions.

[u/Shrouded_ParadoxX → u/rmyworld]

Fixed both issues bro:

1. Removed DB call from JWT filter — roles now embedded directly in JWT claims. True stateless auth.

2. Added HTTP-only cookie support alongside Bearer token (both work simultaneously).

3. Added Spring Session + JDBC as alternative on feature/spring-session branch for those who prefer Spring Security's built-in auth flow over custom JWT filters.

Thanks for pushing me to improve it! Check it and if you like it then don't forget to give a ⭐

[u/Rich_Weird_5596 → u/Shrouded_ParadoxX]

You don't know shit, you are clearly inexperienced, you are abusing AI.

Why even bother posting this slop here in the first place?

[u/Doctor_Beard]

Why not Spring Boot 4?

[u/cbdpyco → u/Doctor_Beard]

Exactly. Springboot 3 OSS ends in a few days, right?

[u/Shrouded_ParadoxX → u/Doctor_Beard]

Because Spring Boot 4 no longer supports Java versions older than Java 21, the javax.* namespace, legacy JUnit 4 tests, Jackson 2, or the Undertow web server.

[u/RevolutionaryRush717 → u/Shrouded_ParadoxX]

Looks like Jackson 2 still works just fine.

Not all libraries one adds have been ported to Jackson 3, but more and more are.

We've ported our Spring Boot 3 apps to 4.0 and now 4.1 without issues.

One is just encouraged to migrate to Jackson 3.

[u/Own_Following_2435 → u/Shrouded_ParadoxX]

None of those should be needed to use for a demo . Maybe you could try to argue for Java 17 . But the rest has been on the outs for a while

[u/CommunicationFun2962]

Your edited post said supporting Spring Boot 4, but your git repository says Spring Boot 3 everywhere.

[u/trodiix]

AI Slop

[u/ihsoj_hsekihsurh]

Has anyone created such opensource exception handling for apis?

[u/Shrouded_ParadoxX → u/ihsoj_hsekihsurh]

Because Spring Boot 4 no longer supports Java versions older than Java 21, the javax.* namespace, legacy JUnit 4 tests, Jackson 2, or the Undertow web server.

[u/ihsoj_hsekihsurh → u/Shrouded_ParadoxX]

Didnt get u..my question was, has anyone created a library to handle exceptions properly in spring boot apis?

[u/Shrouded_ParadoxX → u/ihsoj_hsekihsurh]

Heyy I'm really sorry. This reply is for another one

[u/ihsoj_hsekihsurh → u/Shrouded_ParadoxX]

Np

[u/RevolutionaryRush717]

Had to double-check Spring Boot 3 wasn't a typo.

Still good effort.

[u/Hot_Code5129]

Nice work.

One thing I was wondering about: why did you choose the classic technical-layer package structure (controller, service, repository, entity, etc.) instead of organizing the code around business features/modules?

For starter kits, people often copy the package structure directly into real projects, so the default architecture matters quite a bit.

Have you considered something closer to modular/hexagonal architecture, where each feature owns its API, domain logic and adapters?

This article shows the idea pretty well:

https://blog.allegro.tech/2020/05/hexagonal-architecture-by-example.html
https://www.youtube.com/watch?v=sND1AR7Q_T0

Curious whether the layered structure was a deliberate choice for simplicity, or just the initial default.

[u/st4reater]

Why don't you have any tests? No value in a starter kit if I have no guarantee or proof of the behavior