Throughout the internet I see a lot of libraries for everything, and my question to you is - what is your way of implementing JWT authentication?

Hello,

Anyone here already deploy GraalVM compiled spring boot app in production?

What is you take?

Are you happy with it or is it still not recommended for prod?

The native image have to be tested for sure. how does it feel to have longer build time for native test. Is it the price to pay for efficient memory ?

Most Spring Boot file upload tutorials look fine until you try more than a few users.

In production it’s a different story. Memory spikes, threads blocking, and the app basically choking when multiple large PDFs hit at once.

I stress tested uploads under real load and the “simple” MultipartFile approach starts showing all the ugly edges people skip in tutorials.

Curious what others ended up changing first when they hit upload bottlenecks in Spring Boot?

Hey! I’ve started learning about Hexagonal Architecture and DDD, and I decided to make the jump from theory to practice.

So far, I’ve developed a microservice that I split into three layers: domain, application, and infrastructure. On the domain side, I created the aggregate along with its entities and Value Objects. From what I understand, ports should be the interfaces that handle communication with the domain, and they come in two types: input (driver) and output (driven). Use cases are supposed to act as orchestrators that implement the input ports and use the output ports to make operations possible end-to-end, without messing with the domain logic (I've read about the anemic domain model).

One thing that seems quite strange to me is on the input ports side, where many devs create a separate interface for every single operation. I understand the Interface Segregation Principle, but this kind of implementation feels a bit extreme. I would prefer to group all related operations into a single interface, much like you would do in a controller.

Another point of confusion is related to DTOs (Data Transfer Objects). First of all, a lot of the validation becomes redundant since it's already handled at the domain entity/VO level. Secondly, it feels bizarre not to use Value Objects inside my DTOs. Even though the AI suggested this could cause serialization issues, I don't see the point of just throwing properties in there and repeating everything manually.

The adapters part makes sense to me, though I don’t agree with the definition "implements the ports", except on the output side. On the input side, I see them more as the Adapter pattern, which basically makes two incompatible things compatible, acting as translators for REST, DBs, etc.

Also, should infrastructure entities simply reference VOs and other infrastructure entities, right? A lot of things, like addresses, are going to introduce redundancy at the entity level now. How is this usually handled?

Also, at the application layer, should ports practically be grouped by domain or mixed together? Same question for DTOs.

Given the discrepancies with what I read in articles/books/tutorials, maybe some of you have more practical experience and can tell me how you’ve seen these scenarios implemented correctly and scalably in production.

Thanks!

hello!! so i'm about to enter my first year of university in the US, and my university has a thing called "co-op" where you basically work as an intern of sorts for a company over a 6 month period (either one time or three times), and if they like you enough, they can hire you post-gdad. companies can range from small start-ups to big companies

i'd like to have like 1 or 2 spring boot backend projects before i start applying for co-ops (which will be in ~a year from now), but i'd like to have something that would make me stand out instead of some basic CRUD project. my dilemma is whether i would *have* to do something involving microservices, no matter what the project idea is (as it may look impressive or whatever), or if i have the freedom to choose depending on what my requirements are and it being built as a microservice or not is irrelevant. project ideas aren't exactly my worry tbh because i do have a few in mind and i could probably get some AI to help me with that if I get suuuper stuck; it's
more so that architectural decision yk... what do you think would be the smartest decision for me?

I am confused in both the courses Telesko industry ready course but it only gives microservices in recorded videos on the other hand anuj bhaiya Springboot cohort 5 gives hands on microservices project in cohort 5 which one to choose? Any suggestions?

I have been interviewing recently and noticed there is now an expectation for software engineers to know how to work effectively with AI tools like ChatGPT, Cursor, Copilot, Claude, etc.

Right now I mostly just prompt randomly and use them for generating code or debugging, but there seems to be a more structured way to use them during development — things like prompting properly, code reviews, refactoring, testing, documentation, and general development workflows.

Are there any good practical courses/resources for learning this from a software engineer perspective?

Hey Folks!! 👋

While managing and monitoring financial transactions I found them pretty scattered to be kept track on. Different applications screwed through out.

Recently, I thought of solving it. So, I invite you to go through my Personal Finance Investment Platform (PFIP) but as a developer (🤫 as it's not production ready yet). Be a critique as and when needed.

This isn't just a "CRUD app" with microservices, there's real thought behind the JWT flow, the Redis caching layer, the per-service DB isolation, and the Angular interceptor/guard pattern that keeps the frontend clean and secure.

Drop your feedback below — what would you refactor? What's missing? All constructive thoughts welcome.

Hello,

I am learning spring currently and have come across two flows/philosophies in regards to how the flow should be for transferring data.

The first one I’ve seen is

Controller - Service - Mapper - Repository

This is initially what I’ve been doing, however, I have seen some repositories and comments of people saying best practice is

Controller - Mapper - Service - Repository

Which is correct? Or is it a case by case basis?

​

Sharing my Spring Boot + Angular resource document for anyone learning or building full-stack applications.

Includes tutorials, architecture references, authentication,

deployment basics, and more.

If you need to retire an old API version, but you have no idea which clients are still hitting it, no standard way to warn them, and no clean mechanism to eventually shut it off.

We built spring-api-sunset to solve this. It's a lightweight Spring Boot 3.x starter that manages the full API deprecation lifecycle through a single annotation.

What it does

Add @Sunset to a controller or method:

@RestController
@RequestMapping("/api/v1/users")
@Sunset(date = "2025-10-01", since = "2025-04-01", replacement = "/api/v2/users")
public class UserControllerV1 {

    @GetMapping("/{id}")
    public User getUser(@PathVariable Long id) {
        return userService.findById(id);
    }
}

From that point on, the library automatically:

• Adds RFC 8594 Sunset and RFC 9745 Deprecation headers to every response, so clients can programmatically detect the deprecation
• Adds a Link header pointing to the replacement endpoint
• Returns 410 Gone with an RFC 7807 Problem Detail body once the sunset date passes (configurable — you can also choose to keep serving with warning headers)
• Records Micrometer metrics (api.sunset.requests counter with endpoint/consumer tags, plus gauges for deprecated and sunset endpoint counts)
• Exposes an actuator endpoint at /actuator/api-lifecycle that lists all deprecated endpoints with their dates, replacement URLs, days remaining, and current phase

The problem this solves

Most teams handle API deprecation ad-hoc: a comment in Slack, maybe a custom header someone remembers to add, and a TODO that never gets done. Meanwhile clients keep hitting the old endpoint because there's no machine-readable signal telling them it's going away.

The HTTP standards for this exist (RFC 8594 for Sunset header, RFC 9745 for Deprecation header) but nobody implements them because it's tedious boilerplate. This library makes it a one-liner.

The consumer tracking feature is particularly useful — set spring.api-sunset.consumer-header=X-Api-Key and your metrics will show exactly which API consumers are still on the deprecated version, so you can reach out to them directly instead of broadcasting to everyone.

Configuration

spring:
  api-sunset:
    enabled: true
    on-sunset: return-410    # or "continue" to keep serving with headers
    consumer-header: X-Api-Key

What the client sees

Before sunset — normal response with warning headers:

Sunset: Wed, 01 Oct 2025 00:00:00 GMT
Deprecation: @1743465600
Link: </api/v2/users>; rel="successor-version"

After sunset — 410 Gone with Problem Detail:

{
    "type": "about:blank",
    "title": "Gone",
    "status": 410,
    "detail": "This API endpoint was sunset on 2025-10-01. Use /api/v2/users instead.",
    "instance": "/api/v1/users/123"
}

Details

• Java 21+, Spring Boot 3.4+
• Micrometer and Actuator are optional dependencies — metrics and the lifecycle endpoint only activate if they're on the classpath
• Method-level @Sunset overrides class-level
• Zero boilerplate — just add the dependency and annotate

Available on Maven Central:

implementation("io.github.atlancia-labs:spring-api-sunset:0.1.1")

GitHub: https://github.com/Atlancia-Labs/spring-api-sunset

Would love feedback, especially if you've dealt with API deprecation at scale and see gaps in this approach. What would you add?

How do you set up your spring boot security with reactjs as being the frontend? I use the session based auth (no jwt) for simplicity but the problem is with csrf.

I have ```csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse``` in my csrf web security config too but when i log in and send the form, i can't log in because obviously csrf token isn't there YET. So how can users even get a csrf token first before logging in? I tried using the ignoreMatchers("...") on csrf config aswell, it logged me in but it only sent me the JSESSION and no XSRF token in the header.

Quick heads-up for the Spring Boot crowd: JobRunr 8.6.0 just shipped and the Spring Boot starter (both 3.x and 4.x) now boots the Background Job Server and Dashboard on ApplicationReadyEvent instead of SmartInitializingSingleton.afterSingletonsInstantiated(). That means JobRunr only starts polling once your application context is fully initialized, which avoids a whole class of subtle startup races where a job ran before its dependencies were ready.

Also in this release:

• JDK 26 compatibility (works with --illegal-final-field-mutation=deny)
• Quarkus 3.33 LTS support (yes, also relevant if you run a hybrid stack)
• 40+ minute → 5 second startup on databases with thousands of tables
• Recurring job lookup uses a single MAX query, throughput back to historical levels
• withDetails → withJobLambda rename for the Fluent API (old name deprecated, still works)
• Job logs in the dashboard preserve whitespace now

Release blogpost with code-examples: https://www.jobrunr.io/en/blog/jobrunr-v8.6.0/

I was following a tutorial and I was performing a basic spring app run but it shows whitelabel error page. main app code :

u/SpringBootApplication
public class PatientServiceApplication {

    public static void main(String[] args) {
        SpringApplication.
run
(PatientServiceApplication.class, args);
    }

}

dependencies:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-devtools</artifactId>
        <scope>runtime</scope>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
    </dependency>

</dependencies>

application.properties:

spring.application.name=patient-service


spring.h2.console.enabled=true
spring.h2.console.path=/h2-console
spring.datasource.url=jdbc:h2:mem:testdb
spring.datasource.driver-class-name=org.h2.Driver


spring.datasource.username=admin
spring.datasource.password=password

spring.jpa.database-platform=org.hibernate.dialect.H2Dialect

spring.jpa.hibernate.ddl-auto=update
spring.sql.init.mode=always

server.port=4000

when I try to access localhost at port 4000 and url as "/h2-console' it shows this error:

Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback.

Wed May 13 21:24:38 IST 2026

There was an unexpected error (type=Not Found, status=404).

No static resource h2-console.

org.springframework.web.servlet.resource.NoResourceFoundException: No static resource h2-console for request '/h2-console'.
at org.springframework.web.servlet.resource.ResourceHttpRequestHandler.handleRequest(ResourceHttpRequestHandler.java:526)
at org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter.handle(HttpRequestHandlerAdapter.java:50)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:866)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1000)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:892)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:622)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:874)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:128)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:107)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:107)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:107)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:199)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:107)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:165)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:77)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:113)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:83)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:72)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1801)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:946)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:480)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:57)
at java.base/java.lang.Thread.run(Thread.java:1516)

It***

Creating an ecommerce project, following a course on Udemy, man it is getting way too difficult 😞 Category , Product, their Respective DTOs, there respective repositories

is this normal to experience such difficulty in beginning ?