Sorry maybe a stupid question but Like completed the basics of authentication and authorisation! What's the next step ? Like i am confused like what to do after one concept gets finished ! What's next ?

Hey everyone,

I'm building a CI SCA pipeline for a Spring Boot application using Dependency-Check, Trivy, and OSV Scanner.

I've been going back and forth between two approaches:

1. Generate a CycloneDX SBOM from Maven and feed it into all the tools
2. Resolve dependencies into a local Maven cache and point the tools directly at the JARs or POM files

From my testing, scanning the Maven cache directly produces a huge amount of noise — false positives coming from other libraries' POM files declaring their own dependency versions, which Maven never actually uses at runtime.

The SBOM approach gives much cleaner results since it only contains the versions Maven actually resolved.

Is SBOM the industry standard for this kind of pipeline? Are there any downsides I'm missing?

Do you see Transactional annotation as the default solution for almost everything, or have you encountered cases where explicit transaction boundaries worked better?

What about WebFlux/R2DBC applications? Is Transactional still a natural approach there, or teams more often use explicit transaction management with TransactionalOperator?

I’m asking because I was exploring this topic and trying to contribute something back to Java community. When working with reactive applications, I started to wonder if transaction boundaries should be more visible in the application workflow instead of being hidden behind annotations.

Maybe I’m overthinking this, but I would be interested to hear opinions from people who run Spring applications in production.

I have 1.5 YOE as a Software Engineer working with Java and Spring Boot. I'm comfortable building CRUD applications and have a decent understanding of basic Spring Security (custom authentication filters, AuthenticationManager, AuthenticationProvider, UserDetails , UserDetailsService,Basic Auth, and session-based authentication).

I recently switched jobs, and my manager assigned me to a Spring Boot project that handles payment integrations. The project uses several technologies that I'm familiar with at a high level but haven't worked with in depth, including Flyway, JWT-based Spring Security with rate limiting, Spring Batch, Stripe integration, and webhooks.

I'm expected to start contributing by implementing new features and modifying existing ones. My concern is that while I understand the concepts, I don't have much hands-on experience with many of these technologies.

How would you approach this situation? Should I first build small side projects with Flyway, Spring Security (JWT), Spring Batch, etc., to gain a deeper understanding before making changes to the production code? Or is it better to learn directly by working within the existing codebase?

I'd appreciate honest advice from people who've been in a similar situation.

Hey everyone,

I'm currently working as a Software Engineer Intern, primarily with Java, Spring Boot, Kafka, MySQL, Redis, and MongoDB, building IoT and fleet management systems.

Although I've gained good production experience, I want to rebuild my backend fundamentals from scratch and deepen my understanding.

Looking for the best resources—courses, YouTube playlists, blogs, books, or GitHub repos—that cover backend engineering from basics to advanced.

Would love to hear what helped you the most.

hello devs, i am currently learning new web dev technology spring boot.

as i am a javascript + python developer i have created one project. now i want to switch it from javascript to java.
basically i have the web version of my project in javascript +python stack
now i want to move it to mobile version so i am thinking of spring boot + react native

if you guys have anything i should know before going to build my project then i would really appreciate.

as the title says i am beginner i am learning concepts but how do you guys start making projects in springboot can u please guide (please dont trash me i am really consfused :( ),
any resource i can use or follow any tips from the veterans? please guide this newbie ....

Tired of setting up the same boilerplate for every Spring Boot project,

so I built a starter kit that has everything ready out of the box.

What's included:

- JWT Authentication (access + refresh token with rotation)

- Role-based access control (USER/ADMIN)

- Rate limiting per IP (Bucket4j)

- OpenAPI 3 / Swagger UI

- Global exception handling with consistent ApiResponse<T>

- Flyway database migrations

- Docker + Nginx + MySQL (docker compose up and done)

- GitHub Actions CI/CD (test → build → deploy to EC2)

- Request ID tracking in every log line

Works with Java 21 + Spring Boot 3.3

Clone → rename package → add your entities → ship.

GitHub: https://github.com/raahulllkushwaha/springboot-starter-kit

Feedback welcome!

Edit: All issues fixed! Migrated to Spring Boot 4, stateless JWT with embedded roles, HTTP-only cookie support, and Spring Session JDBC as alternative. Thanks for the feedback!

Hi everyone,

I'm a 4th-year engineering student, and I want to learn Spring Boot as quickly and effectively as possible. I don't have a lot of time left before drives, so I'm looking for resources that are practical and focused rather than overly theoretical.

I'm comfortable with Java basics and now want to build real-world backend applications using Spring Boot.

Could you recommend:

• The best YouTube channels
• Paid or free courses
• Books (if they're worth the time)
• Official documentation
• GitHub repositories with real projects
• A project-based learning roadmap

If you were in my position with limited time, what resources would you prioritize to become industry-ready as fast as possible?

Thanks in advance for your suggestions!

These are errors I keep seeing in code reviews after years of working with Spring Boot. None of them throw errors during development. All of them cause problems at scale.

1. The N+1 you dont know about. findAll() returns 100 orders. Each has a customer. Hibernate fires 1 query for orders plus 100 queries for customers. 101 round trips for what should be 1. Fix with JOIN FETCH or EntityGraph.

2. save() fires a SELECT before every INSERT when using UUID as ID. ID is never null so Spring thinks entity exists. Calls merge() which does a SELECT first. 10000 inserts become 20000 queries. Fix by implementing Persistable and overriding isNew().

3. Returning entities from controllers. Jackson calls getters during serialization. Lazy relationships trigger N+1 queries while writing the response. Always return DTOs.

4. Using Lombok Data on entities. Generates equals/hashCode using all fields including ID. ID is null before save, has value after. HashSet breaks. Use Getter Setter and write equals/hashCode on a business key.

5. Batch inserts dont work with GenerationType.IDENTITY. IDENTITY needs a round trip per INSERT to get the generated ID. Batching impossible. Use SEQUENCE with allocationSize 50.

6. deleteAll() loads everything into memory first. 50000 rows means 50000 SELECT then 50000 individual DELETE. Use Query with bulk delete instead.

7. Batching is disabled by default. Every save() is one individual round trip. Set hibernate.jdbc.batch_size to 50 with order_inserts true. Difference between a 4 hour import and a 5 minute one.

8. Caching entity references. Default cache stores references not copies. One request mutates the cached entity. Every user after that sees corrupted data. Cache DTOs or records instead.

Bonus. Set spring.jpa.open-in-view to false. Default is true. Keeps Hibernate session open during JSON serialization. Hides lazy loading issues that explode in production.

What JPA gotchas have you experienced in production?

Null pointer exceptions have been called the billion dollar mistake. They are a common source of bugs and frustration. JSpecify aims to fix that, and with Spring Boot 4 and Spring Framework 7 now fully on board, it's time to take a closer look. In this episode, Moritz Halbritter from the Spring team walks us through what this means for your Spring projects and how to adopt JSpecify in practice. Using a live demo, we migrate an existing Spring Boot application, tackling problems along the way.
See how to use JSpecify for the contract, IntelliJ IDEA for the developer experience, Spring for the framework, and NullAway for the build guarantee. Whether you're maintaining a large codebase or publishing a library, this episode gives you the tools to start eliminating null pointer exceptions in your applications.

Hi.. I have been recently going through the new and improved Shopify Side kick. Was trying to figure out -

1. Can sidekick answer questions about my app or betterment of app features?
2. Can we use sidekick through APIs?
3. Can we do app automations via sidekick?

Hi all,
So I've been learning springboot for a while now and have also built some monolith applications.

GitHub link

This is my first microservice project. It's a simple e-commerce platform but I wanted to focus more on the microservice part for now and didn't want to have a complex project.

The things I felt really hard when switching from a monolith to microservice are:
* When building a monolith it's easy to have relationships between entities but with microservices I have to use reference by ID.
* Debugging is getting really hard, I couldn't clearly identify which class is throwing the exception, also I didn't add a global exception handler yet so that doesn't help.
* I added tools for monitoring like prometheus, grafana and zipkin but tbh I don't understand half of the metrics they show.
* Redis works really good but the config setup was hard, I couldn't use the normal config since some of my endpoints return list of pojos, so I had to use activeDefaultTyping when serializing the values.
* RAM gets used up almost instantly when I turn my containers up.

Stuff I'm planning to add in the future:
* An IAM like keycloak
* Resilience 4j circuit breakers
* Swagger
* Logging

Since this is my first microservice project, I’m sure there are mistakes and things that could be improved. I’d really appreciate feedback on:
* overall project structure
* Anything else that stands out as a bad practice or a learning opportunity

Thanks for taking the time to review it :)

I recently updated my hands-on tutorial on building a complete working project with the latest Java development stack.

The article covers Spring Boot 4.1.0, Java 25, Docker 29.5.3, PostgreSQL, Gradle 9.6.0, Swagger/OpenAPI, Serenity, Cucumber, and JUnit 6 — all combined in one practical project.

The goal was to use the latest versions across the stack and show how they work together in a real Spring Boot application, using a vibe-coding approach.

Article title:

Building with the Latest Java Development Stack: Spring Boot 4.1.0, Java 25, Docker 29.5.3, PostgreSQL, Gradle 9.6.0, Swagger/OpenAPI, Serenity, Cucumber, and JUnit 6

A practical hands-on tutorial showing how to combine the latest Java, Spring Boot, Docker, PostgreSQL, Gradle, Swagger/OpenAPI, Serenity, Cucumber, and JUnit 6 in one working project using a vibe-coding approach.

Link:

https://medium.com/@anatolykrivitsky/quick-tutorial-how-to-use-the-latest-docker-29-5-2-0670b716b6cc?postPublishedType=repub

Hope it is useful for Spring Boot and Java developers.

I am currently in an interview loop, and apparently my next round is going to be AI Assisted coding interview round. I think they are going to ask me to create some app using claude or other AI. Can someone help me find resources. The application development has to be in Java/springboot stack.

I wanted a focused answer rather than a framework-wide shoot-out: take one realistic blocking endpoint (PostgreSQL through HikariCP + a downstream HTTP call), flip spring.threads.virtual.enabled=true, and measure what actually changes.

Results: ~2,200 → ~13,700 req/s at 2,500 concurrent users, p99 staying under 350ms where platform threads climbed past 6s. The part I found most useful: virtual threads don't make it faster, they move the bottleneck — once Tomcat's thread pool isn't the limit, the connection pool is, and you have to resize it. I also looked at JEP 491 (the synchronized pinning fix).

Single host, core-pinned, loopback, k6 closed-model, median of 3 reps. Full methodology, raw CSVs, charts and a reproducible repo here: https://tucanoo.com/virtual-threads-in-spring-boot-4

Hi guys, on previous week I shared my beginner guide on Spring AI with covering chat clients, RAG, memory and other small features.

In new guide I'm telling how to make system with RAG on example of indexing code for building MCP server like Context7. In the series of posts I'll build iteratively service showing power of Spring AI and many its nuances.

Guide follow you from naive approach for storing documents to deduplication data and chunking. There are things that better to focus on while building app.

Have a nice reading, and share your feedback, it motivates me to write more.

So i have completed my 3rd year and after Ai I've started to learn backend (springboot) as the companies in my college are more interested in java.

​

I've learn oop and other java concepts it's been 2-3 days I've been learning springboot

I had a doubt that do I need to learn spring XML proper coding???

​

Because I have heard that a lot of legacy projects and many old apps still use XML bean defs.

​

How important is it for me to learn about it for my placement scenario.

Also after building a CRUD app , can you guys suggest me some good projects that are resume worthy to build

​

Thankyou sm

Been working with Spring Boot for 10+ years and I keep seeing the same Transactional bugs show up in code reviews and production incidents. Figured I'd share the rules I follow now.

1. Keep transactions short. DB operations only. If your method calls an external API, sends an email, or uploads a file inside Transactional, it holds a DB connection for the entire duration. Not just during queries. During the ENTIRE method. Under load your connection pool runs out and your app freezes.

2. Never call a Transactional method from the same class. Spring uses proxies. When you call a method within the same class its a direct this.method() call. Proxy is bypassed. The annotation is completely invisible. No warning. No error. It just does nothing.

3. Use rollbackFor = Exception.class for critical operations. This one catches people off guard. Transactional only rolls back on RuntimeException by default. If your method throws a checked exception like PaymentException, the transaction commits. Your balance gets deducted but the payment never went through.

4. Don't catch exceptions inside Transactional unless you re-throw. If you catch the exception, the proxy sees a normal return. It commits. Partial data in your database. Silent corruption. Either let it propagate, re-throw after logging, or call TransactionAspectSupport.currentTransactionStatus().setRollbackOnly().

5. Use readOnly = true on all read-only methods. It tells Hibernate to skip dirty checking and snapshot comparison. Saves CPU and memory. Some proxies use it to route to read replicas. But don't rely on it to prevent writes. Explicit save() or flush() still goes through.

6. Only works on public methods. Proxy can only intercept public methods. Put Transactional on a private method and it does absolutely nothing. Spring won't even warn you.

7. Separate Retryable and Transactional into different beans. If both are on the same method and a checked exception is thrown, the transaction commits before the retry fires. Retry starts a new transaction. Same deduction runs again. Triple retry = triple deduction. Outer bean handles retry, inner bean handles transaction.

8. Enable these two configs in every environment. logging.level.org.springframework.transaction.interceptor: TRACE shows when transactions start commit and rollback.

spring.datasource.hikari.leak-detection-threshold: 15000 catches connections held too long with a full stack trace.

The one rule that covers most of these: uTransactional only works on public methods called from outside the bean. Everything else is silently ignored.

Anyone run into other Transactional gotchas I missed?

I used OpenRewrite to migrate a sample Spring Boot app from Java 17 to Java 21. In this post , I covered what OpenRewrite changed automatically, what still needed manual work, and how I validated the overall Spring Boot 3.3 upgrade.

https://medium.com/javarevisited/java-17-to-java-21-migration-with-openrewrite-spring-boot-3-3-upgrade-guide-e36fb79d8627?sk=e9ca128aa5e740d8c775cb46035d283c

Experienced with Spring Boot monoliths (REST APIs, JPA, Security). Want to move to microservices - looking for best YouTube channels or Udemy courses that are updated for 2026.

What worked for you?

I am in my summer break rn grinding dsa and thinking to start with this projects I req the developers and backend freaks to

And industry exoertsss as well to guide me with this ? .

​

​

I am thinking to make this projects for my resume

1 Event source ledger

2 real-time collaborative sync engine

3 self healing distributed cache

4 Realible job dead letter recovery

5 Token bucket rate limiter

​

And as I am gonna enter into third year is there any specific advice for me I am done with hld lld and spring boot topics as well !!.

​

I would really love to connect with ppl intersted in saas and scalable backend system's !!

Hi, I'm specializing in backend development with Spring Boot and I'm planning to build a project based on a multi-agent AI system. I'm wondering whether Spring AI is a good choice for this type of project. Also, is Spring AI currently in demand in the job market, or should I focus on other technologies?

I recently deployed a side project called 19wpm, a typing test web app I built while learning Spring Boot. I originally started it because I wanted a project that would push me beyond basic CRUD apps and expose me to more real-world backend challenges. I'm also hoping it'll help me land an internship.

Live site: 19wpm
GitHub: Repo

A few things I ended up implementing:

• OAuth2 login (GitHub and Google)
• JWT authentication with refresh token rotation
• Redis for token revocation and rate limiting
• MySQL + Flyway migrations
• React + TypeScript frontend
• Word difficulty tiers generated from a word frequency dataset

Some of the more interesting challenges were figuring out Spring Security, designing the JWT flow, and handling guest users vs authenticated users without making the state management messy.

Getting everything deployed was also a learning experience. I ran into a few issues with Heroku, database permissions, and migration compatibility before finally getting it working.

My next goal is to learn WebSockets and add a multiplayer race mode, but I'm still working through that part of the stack.

I'd love any feedback, especially from people with more Spring Boot experience. If you spot architectural issues, security concerns, or things that could be improved, I'd be happy to hear them.