Hacking with Spring Boot 2.4: Classic Edition - podcast episode cover

Hacking with Spring Boot 2.4: Classic Edition

Oct 28, 202522 min
--:--
--:--
Download Metacast podcast app
Listen to this episode in Metacast mobile app
Don't just listen to podcasts. Learn from them with transcripts, summaries, and chapters for every episode. Skim, search, and bookmark insights. Learn more

Episode description

A structured approach to developing applications using Spring Boot. It covers foundational concepts like building web apps, data access, and developer tools, while also exploring advanced topics such as testing, production operations (including Docker and GraalVM), and building robust APIs. The book further examines messaging solutions and securing applications with Spring Security and OAuth. Throughout the text, the author emphasizes practical application with code examples and best practices, making it a valuable resource for developers aiming to master Spring Boot.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cyber_security_summary

Get the Book now from Amazon:
https://www.amazon.com/Hacking-Spring-Boot-2-4-Classic-ebook/dp/B091V773N4?&linkCode=ll1&tag=cvthunderx-20&linkId=3533785b9a956a833ad019bc21099659&language=en_US&ref_=as_li_ss_tl

Discover our free courses in tech and cybersecurity, Start learning today:
https://linktr.ee/cybercode_academy

Transcript

Speaker 1

Welcome to the deep dive, where we try to sift through all that information overload to bring you the insights you actually need fast. Yeah.

Speaker 2

There's so much out there, exactly.

Speaker 1

And today we're tackling a challenge that well, it plagues nearly everyone in software development, especially I think in the Java world. How do you keep up with all the constant change and build really high quality applications without just getting bogged down in endless configuration and boilerplates.

Speaker 2

Oh yeah, it feels like a constant battle sometimes.

Speaker 1

It really does, doesn't it.

Speaker 2

It absolutely does, And that's precisely why our deep dive today into hacking with Springboot two point four classic addition feels so relevant. Okay, spring Boot has I mean undeniably become a cornerstone of modern Java development for sure, and our mission here really is to extract the core insights from these sources to reveal how it acts as this powerful shortcut not just for productivity, but maybe for a deeper understanding of building truly robust, maintainable apps.

Speaker 1

Okay, so let's unpack this then. What is spring boot at its heart? The sources seem to frame it as powerful but also surprisingly simple.

Speaker 2

Yeah, that's a good way to put.

Speaker 1

It, defined by four key characteristics. It's fast, opinionated, portable, and production ready. The sound like pretty strong claims for streamlining the entire application life cycle.

Speaker 2

They are strong claims, and each word holds significant weight. When we say opinionated, what we're really talking about is spring Boot's genius for making smart, sensible assumptions. It looks at the libraries you've added. Say you add spring Web or a database connector, right, and it automatically configures a lot of the common settings for you. It's almost like having a seasoned expert looking over your shoulder saying, okay, given these tools here are probably the best of faults.

Speaker 1

Oh okay, So it makes educated guesses.

Speaker 2

For you precisely. And the beauty is these defaults dramatically cut down on configure But and this is key, you can always easily override them if you're project need something specific. This magic, as people call it, is driven by things like autoconfiguration and component scanning. They just, you know, effortlessly wire up your applications parts. Plus, it bundles embedded surflet containers like a patche Tomcat directly into your application.

Speaker 1

Right, So no more wrestling with server installations just to get a basic Hello World running exactly.

Speaker 2

It eliminates that entire headache, especially when you're just starting out.

Speaker 1

So it's not just about speed in writing the code, but speed to that first run. I remember the old days spending hours just getting a server set up.

Speaker 2

Hours. Yeah, And the perfect starting line for this nowadays is the Spring initializer. You know, start dot spring dot io.

Speaker 1

Oh yeah, I've used that.

Speaker 2

It's great, It is great. This web tool just quickly generates a project tailored to what you need. You pick your essential dependencies like spring web for web apps, time leaf maybe for templates, Spring boot test, which is crucial, absolutely crucial. The source material even highlights how it unconditionally inc includes spring boot starter test. It really underlines how vital testing is today.

Speaker 1

So you get a well structured, testable project right out of the gate in seconds.

Speaker 2

In seconds, it's a significant head start.

Speaker 1

Okay, so you've got this project generated, ready to go. What's the next step to actually turn it into something deployable.

Speaker 2

That's where the spring boot Maven plug game comes into play. It takes to your application all as dependencies everything okay, and packages them into a single self contained executable JR file. People often call it an.

Speaker 1

Uber JR right, the fat jar.

Speaker 2

Exactly, the fat jar, and this file is incredibly portable. You can run it anywhere a JDK is present with just a simple Java jar command. It really simplifies distribution.

Speaker 1

Someone I think it was Josh Long once said working with spring boot is like pair programming with the Spring developers.

Speaker 2

That's a perfect analogy, and I.

Speaker 1

Think that beautifully captures this feeling of well, almost effortless productivity. So, okay, we've establish that foundational magic. How does it translate into like faster, more effective daily work for developers, especially when we move beyond just the initial setup right.

Speaker 2

Because setup is one thing, but the day to day coding is where you spend most of your time.

Speaker 1

Exactly with the project up and running fast, the next big thing is usually the database. I mean, let's face it, almost no application lives about.

Speaker 2

Data, pretty much none.

Speaker 1

Yeah, So how does springboot take its philosophy of speed and dare I say fun into the often complex world of data management.

Speaker 2

It does this really elegantly through Spring Data JPA. Okay, this framework significantly cuts down the boilerplate code you need for data access. Instead of writing endless SQL or you know JPQL queries. You define simple interfaces, we call them repositories. And here's where the real power comes in, query derivation.

Speaker 1

Query derivation explain that?

Speaker 2

Okay? So you can just declare a method name in your repository interface like find by name containing string partial name, and spring Data looks at the method name, parses it, and automatically figures out and constructs the correct SQL query for you. You don't write the query code, You just describe what you want to find by naming the method.

Speaker 1

Wow. So less time writing repetitive sequel, more time focusing on the actual application logic. That sounds like a huge win for developer flow.

Speaker 2

It absolutely is, And for more complex stuff like dynamic search scenarios, spring Data offers something called query by example.

Speaker 1

Okay, how does that work?

Speaker 2

Well? Instead of creating like a million custom finder methods or those awful switch statement nightmares in your service layer to handle every possible search combo.

Speaker 1

Yeah, I've seen those right.

Speaker 2

Instead, you just assemble a simple probe object with the criteria you want to search on. You pass that probe to spring data, and it intelligently constructs the query based on the fields you set in the probe.

Speaker 1

That sounds much cleaner.

Speaker 2

It's incredibly clean, and it relates directly to something Greg Elternquis said, which our sources is highlight code you don't write has no bugs.

Speaker 1

H that's a good one and true.

Speaker 2

It's not just clever, it's fundamental. It directly reduces the places where errors can creep in less code, fewer bugs.

Speaker 1

A powerful principle. Now you know the old developer cycle code compile, waight, test, debug, repeat. Oh the waiting, those constant stop and start cycles, that mental tax of context switching. It can really drain your creativity. Yeah, how does springboot step in to maybe re engineer that daily rhythm make it less of a chore.

Speaker 2

This is where springboot deap pools is pretty indispensable. It's a specific module designed explicitly to slash those development loop times.

Speaker 1

Okay, dev tools, how does it work? Its magic?

Speaker 2

The secret is this really intelligent reloading mechanism. When you change your application code a Java class, for example, dev tools doesn't do a full application restart. Instead, it very precisely reloads only your modified classes, leaving the core framework and libraries running. It uses separate classloaders to achieve this, So.

Speaker 1

It's much faster than a full.

Speaker 2

Restart, massively faster. We're talking near instant feedback, sometimes cutting out those really frustrating weights we all remember.

Speaker 1

So not a full server reboot every time I hit save. That's a huge difference from the old days. I remember how much time we'd lose just waiting. What's the biggest gain you see teams get from this?

Speaker 2

Honestly, it's reclaiming cognitive energy, that constant interruption, that mental context switch. Every time you wait for a restart, it just vanishes. Developers stay in the flow. They can iterate on ideas much more rapidly. Makes sense, and def tools also provides helpful property defaults just for development. Like it automatically disables template cashing, spring dot timeleaf dot cash false is set for you.

Speaker 1

Oh nice, so you're not fighting stale cases during dev exactly.

Speaker 2

You don't have to manually tweak settings for your dev environment versus production. It just handles common sense to faults. Plus, it throws in things like liver load support for automatic browser refreshing handy, and it can activate increased web level logging for easier debugging with just a simple property logging dot level, dot webdbug. It basically automates away all those little frictions that add up and slow you down.

Speaker 1

Okay, so we've covered making development and iteration faster, even more enjoyable. But the ultimate goal, right is getting your application out there into production. How does Springboot help turn getting to production from maybe a frantic scramble to a more confident process.

Speaker 2

It aims to make deployment remarkably smooth. We already touched on those uber jars.

Speaker 1

Right, the self contained executables.

Speaker 2

Yeah, they give you incredible portability, just Javajar and your running. Yeah, but today containers are often the standard, right Docker everywhere?

Speaker 1

M definitely. So what's the spring boot story for Docker?

Speaker 2

It's got fantastic Docker integration. Now you can use traditional layer Docker files, and spring helps you optimize those layers for better caching of dependencies. Okay, but for an even simpler, almost zero Docker file approach, Springboot provides directly integration with Piquito build packs.

Speaker 1

Build packs what are those exactly?

Speaker 2

They're like smart systems that know how to build container images for specific types of applications like Java apps, without you needing to write a Docker file. Spring Boot integrates this via the springboot dot build image maven or gradal command.

Speaker 1

So one command and it builds the container.

Speaker 2

Pretty much, This single command builds a production ready container image for you. It automatically follows best practices, applies optimal layering for Docker caching, handle security patching. It removes the need to manually write and maintain Docker files.

Speaker 1

Wow, eliminating the Docker file That sounds like a big weight off of developers shoulders, especially for consistency. How does that help bigger teams or CICD pipelines.

Speaker 2

Yeah, for larger teams in CICD, it standardizes the build process, completely reduces errors, ensures everyone builds containers the same optimal way, and it also positions you well for future tech like grill.

Speaker 1

Vm ah native images. That's been getting a lot of buzz.

Speaker 2

Right the grell vm integration usually via Spring Native, which is well, it's been experimental, but maturing fast is a potential game changer. It compiles your spring boot app ahead of time into a native executable and the benefit is radically reduced startup time and a much smaller memory footprint. Our source material actually mentions an impressive startup time of like zero point two two six seconds for a Grail VM native image.

Speaker 1

Who under a quarter of a second blink of an eye.

Speaker 2

This is transformative for things like serverlest functions or micro services that need to scale up super fast, or just running in resource constrained environments.

Speaker 1

Yeah yeah, that kind of speed changes the economics of how you deploy and scale things. Okay, so application is built, containerized, maybe even native, it's deployed. What about day two keeping an eye on it troubleshooting? This is where spring boot Actuator comes in right precisely.

Speaker 2

Actuator is basically a suite of production ready features built right in from monitoring and managing your running application. It exposes several helpful and point over HTTP or JMX.

Speaker 1

Like what kind of endpoints?

Speaker 2

Well, the classic one is Actuator Health. It gives you an immediate status up or DWN simple.

Speaker 1

But essential get basic health check.

Speaker 2

But it gets smarter with a simple property setting like management, dot endpoint, dot health, dot show details always. It automatically includes diagnostic details from components it knows about, like your database connection status, disk space usage.

Speaker 1

Wait, so it knows about my database connection and disk space automatically without me coding custom checks.

Speaker 2

Yes, through that clever auto configuration. Again, it detects those components and includes relevant health indicators. This gives your ops team rich real time insights without you writing extra code.

Speaker 1

That is smart. What else, then.

Speaker 2

There's actuator info. You can use this to embed critical application details the exact build version, maybe the Java version it's running on, even the get commit id it was built from.

Speaker 1

Well, that's useful for debugging issues reported by users.

Speaker 2

Invaluable. Imagine a support call they can instantly check out actuator info and see if the user is running an old build No guesswork, But maybe one of the most powerful is actuator loggers bloggers.

Speaker 1

What does that do?

Speaker 2

This endpoint lets you dynamically view and change logging levels at.

Speaker 1

Runtime, change them while it's running.

Speaker 2

Yes, imagine a tricky production issue. You can temporarily dial up the logging for a specific Java package to say debug or even trace level. Watch the logs to see exactly what's happening, capture the information you need, and then dial it back down to ANFO or warn all without restarting the application or deploying new code.

Speaker 1

Wow. That ability to change logging on the fly in production, no restart That sounds like an absolute life saver for hunting down elusive bugs.

Speaker 2

It really really is. It's incredibly potent for live system debugging. And there are others too, like Actuator thread dump for analyzing thread states.

Speaker 1

Useful for deadlocks or performance issues exactly.

Speaker 2

Actuator heap dump generates a memory snapshot file and each prof file for deep memory analysis. If you suspect leaks, an Actuator TTP trace can track recent HTTP request response pairs, though you need to configure an in memory HTTP trace repository being for that one. It's a whole toolkit.

Speaker 1

It sounds like an incredibly powerful diagnostic toolkit. But with all that information potentially exposed, security must be a huge concern, right. You can't just leave all those endpoints open.

Speaker 2

That is an extremely important point. You absolutely must be careful. By default, only a few safe end points like health and info might be exposed over the web. You have to explicitly configure which other endpoints you want to expose using the management Dot endpoints dot web dot exposure dot include property.

Speaker 1

Okay, so it's opt in for the sensitive ones.

Speaker 2

Yes, and you should never just use to expose everything. That's a major security risk. You pick only what you need. Springboot provides robust security integration, usually with Spring Security, and you absolutely must use it to protect these endpoints properly makes sense.

Speaker 1

Secure by default explicit exposure, right, and you.

Speaker 2

Can also customize the base path, maybe change actuators to manage or something less guessable, just as another small layer.

Speaker 1

Good tip. Yeah, okay, So what's really fascinating here is how spring Boot helps build not just the app's core, but also its interfaces. Let's talk APIs. They're how our apps talk to the world or even to each other.

Speaker 2

Absolutely, and building simple Jason Web services with springboot is incredibly fluid. You use annotations like at rest controller, which tells Spring that the return value of your method should be automatically serialized, usually to Jason and written into the response body. And if you need more control, you can use response entity to set specific HTTP status codes like to a one created when you make a new resource or headers.

Speaker 1

Pretty straightforward for basic zero at APIs.

Speaker 2

Very but the real critical challenge for any API isn't just building version one point zero, it's managing API evolution.

Speaker 1

Ah, yes, how do you change things later without breaking everyone who's already using your API? That can cause chaos.

Speaker 2

Exactly, broken clients, widespread outages, costly refactoring efforts. It's a huge problem for long lived APIs. This brings to mind some interesting research by Jean Jacques dubray on the costs of versioning.

Speaker 1

Okay, what did that study find?

Speaker 2

Well, Dubrae identified basically three common patterns for API evolution. There's the knot where everyone is tied to one version, making any change super risky because it affects everyone I spakes. Then there's point to point where you maintain multiple versions of the API simultaneously. Think V one, v two, v three. Right, you see that a lot you do, but it drastically increases the maintenance burden on the server side. Yeah, you're

supporting multiple code paths. The ideal, according to the study showing the lowest cost increase over time, is compatible versioning. Compatible version yeah, where you evolve the API on the same endpoint, adding new features or data, but in a way that doesn't break existing clients. They just ignore what they don't understand. This is really the gold standard for long term API health and sustainability.

Speaker 1

Okay, that makes sense. So if compatible versioning is the goal, how does spring boot help achieve that elusive backward compatible API you mentioned hypermedia earlier.

Speaker 2

Hypermedia is the absolute key think about why the World Wide Web itself is so successful and resilient. It didn't just give us static documents. It wetted data with navigational links. Click a link, go somewhere else, do something else.

Speaker 1

Okay.

Speaker 2

Spring heshat eoas hypermedia as the Engine of Application State is a project in the Spring ecosystem specifically for this. It gives you tools like entity model, collection model and link.

Speaker 1

Objects And what do these do?

Speaker 2

They let you infuse your API responses with these affordances, basically links that tell the client what actions are possible next based on the current state of the resource.

Speaker 1

So instead of the client guessing.

Speaker 2

Exactly, instead of the client having hardcoded logic like if the order status is pending, then show the cancel order button. The API response for that penning order would actually include a link with a relation type maybe will cancel. The client just looks for that specific link relation. If the cancel link is present in the response, it shows the button. If the order is shipped and the ATI doesn't include that link anymore, the button disappears.

Speaker 1

Ah, So the API tells the client what actions are currently valid. The client doesn't need to know the business rules behind.

Speaker 2

It precisely, it shifts the burden. The client moves from needing deep domain knowledge understanding the intricate business rules to needing only protocol knowledge understanding how to find and follow links. This fundamentally decouples the client and server. The server can now evolve its business logic and workflows, adding or removing available actions by just changing the links it sends back. The client adapts automatically.

Speaker 1

That sounds like a profound shift in API design. Less brittle clients.

Speaker 2

Much less brittle. And this approach also works really well with metadata formats like ALPS Application Level Profile Semantics. ALPS acts like a machine readable blueprint describing the meaning of your links and response structures. This is what true rest is really about, by the way, far more than just pretty urris or using JSON. It's about these hypermedia controls.

Speaker 1

Okay, this is powerful stuff, but also raises a big question. How do you document these kinds of dynamic evolvable APIs effectively? Yeah? And crucially, how do you stop that documentation from becoming instantly outdated? Which is, let's be honest, a chronic problem.

Speaker 2

Yes, stale documentation is the worst. That's where another Spring project, spring rest stocks comes in and is frankly brilliant.

Speaker 1

Okay, rest doos what's the approach?

Speaker 2

It takes a completely test driven approach. Instead of writing documentation manually separate from your code, which yeah, always gets out of sync always, Instead, your existing integration tests or

controller tests automatically generate documentation snippets. Snippets like things like example curl requests, the exact HTTPE request headers and body, the corresponding HDDPU response headers and body example Jason payloads, all captured directly from tests that are actually running against your working API code.

Speaker 1

So the documentary is generated from the tests that prove the API works as expected exactly.

Speaker 2

Because the snippets come from passing tests, they are guaranteed to be accurate and reflect the current state of the API. If you change the API in a way that breaks a test, the test fails. If you update the test to pass with the API change, the generated snippets automatically.

Speaker 1

Update to So if my API changes and I forget to update the tests that generate the docks, the build potentially fails. That's a fantastic way to enforce accuracy. It is.

Speaker 2

It forces documentation to become a first class citizen in your development workflow, not an afterthought. These accurate snippets are then easily integrated into a nice API portal, usually using a side dooc formatting and some maven or gradal plugins. Yeah. It's a lightweight markup language, very suitable for technical documentation,

and spring rest docks integrates beautifully with it. You can even configure your spring Boot application to serve this generated a side dooc documentation directly.

Speaker 1

So the docs live right alongside the API.

Speaker 2

They describe correct, ensuring it's always deployed with the code it documents, effectively killing the problem of stale documentation reaching your API consumers. Restos also provides handy preprocessors like pretty print to format JSON nicely, or mask links if you want to simplify hypermedia links in the examples, it gives you control over the final output for clarity.

Speaker 1

Wow, Okay, we have covered a ton of ground today. It feels like an incredible journey through spring Boot, doesn't it. We're really from making that initial development just blazing fast with opinionated defaults and tools like dev tools that give you back your mental flow to enabling robust, less error prone data access with Spring data, simplifying deployment dramatically with portable jars, and even zero docrophile container builds.

Speaker 2

Yeah, the bill packs.

Speaker 1

Streamlining operations with actuators insights, and finally really empowering truly evolvable, resilient APIs through hypermedia and self documenting tests with rest doocs.

Speaker 2

It's clear I think that the core value you proposition holds true. Spring Boot handles so much of the complex, often tedious infrastructure for you, which frees you up as the developer to shift your focus away from that repetitive plumbing and onto delivering the unique innovative business value that only you can build. It's just a remarkably adaptable toolkit, constantly evolving, too ready for traditional web apps or even cutting edge stuff like native images.

Speaker 1

It really feels like it meets you where you are. So here's the thought to leave you with until our next deep dive. Given spring boots whole philosophy of making development faster, more efficient, what core infrastructure problem your current project right now could maybe benefit most from a pre baked solution like the ones we've discussed. Something that if solved, would free you up to focus more on that unique business value, something to chew on,

Transcript source: Provided by creator in RSS feed: download file
For the best experience, listen in Metacast app for iOS or Android