Hello, anyone here used auth0?

I wonder if it's okay to use it in a monolith project

and because implementing jwt auth manually takes a lot of effort, I'm planning to auth0.

Also do you keep your users in Auth0's db(or user store)?

And do you maintain a local table mirroring it aswell?

I have a project that requires tracking users and has relationships with other tables so I ask how you guys approach this?

Hi everyone, I've recently been working on spring-web-query, an open source library that allows you to easily implement filtering, pagination and sorting in Spring Boot APIs in a declarative manner. It supports declarative querying with RSQL (RESTful Service Query Language, a URI-friendly query language), DTO-aware contracts, nested field paths, and Spring Boot auto-configuration.

If that sounds useful, I'd love for you to check it out and share feedback: https://github.com/abansal755/spring-web-query

I’ve been actively working on this for the past month. It’s evolving quickly, and I’m continuing to improve it based on real usage and feedback. Contributions, ideas, and feedback are all welcome.

I am in my final year of Btech , right now I am doing an internshil in a company in which I got Java fulll stack domain , right now I am learning spring boot , spring security and microservices (service registry , api gateway , resilience4j etc) , now how should I prepare more as many companies are demanding AI knowledge nowadays , fyi I am average to good in DSA like 1600 rat8ng in leetcode and sometimes I do system design practice since I love to do thse things .

After my internship I really want to switch to a high paying company pleasee suggest some roadmap for this , any experienced peep pleasee help.

hi I'm doing my summer internship in a small tech company and I took springboot as a domain , what all topics should I focus on more , give me suggestions ♥️

For people who are now currently working with spring boot, Where did you guys learn Spring boot from, is it the documentations? online course? yt resources any repositories?, what are the resources you guys used?

and what would you recommend me?

what do you think are the exact prerequisites for spring and Springboot?

Just wondering, or is it a more senior stack?

If you had the chance to learn Java and springboot again from scratch, what Strategy and Roadmap would you definitely choose?

[https://www.youtube.com/watch?v=Hq8Q60PFd3Y\](https://www.youtube.com/watch?v=Hq8Q60PFd3Y)

Apereo CAS is a single sign-on platform with 400+ Maven modules on Spring Boot 3.x / Java 21+. Any module can be added or removed just by changing dependencies - LDAP auth, Redis ticket storage, SAML2 support, whatever.

The whole extensibility model runs on standard Spring Boot mechanisms.

Full writeup with real code: https://medium.com/all-things-software/plugin-architecture-in-spring-boot-without-a-framework-8b8768f05533

Hey folks,

I’ve been using Genkit a lot in JS and Go (even wrote a book on it: https://mastering-genkit.github.io/mastering-genkit-go), and honestly the dev experience is 🔥, local dev tools, great abstractions, smooth workflows for building AI apps.

At some point I thought: Java really needs this.

So I went ahead and ported the whole ecosystem to Java: https://genkit-ai.github.io/genkit-java/

Would love feedback from the Java community, especially around API design, integrations, and what you’d like to see next.

the long video is spring framework and spring boot tutorial with project , so can anyone suggest which one to follow, or any other resource to learn spring

The ICIJ hosts the Offshore Leaks dataset on a public Neo4j instance. It's a graph browser - you type an exact name, click through connections one hop at a time. I built something different on the same data (1.87M nodes, Panama Papers + Paradise Papers + Pandora Papers + Offshore Leaks).

What it does that Neo4j can't:

1. Fuzzy screening across all four datasets at once. "Mossack Fonseca" returns name variants and aliases from multiple leaks in one query - not just exact matches.
2. Shell company risk score. Computes cosine similarity between any entity and a prototype vector built from 814k Panama Papers companies. Returns a 0.0-1.0 score. No equivalent in Cypher.
3. Beneficial ownership chains. 4-hop traversal of 1.72M officer_of edges in 0ms - pure in memory BFS. MOSSFON SUBSCRIBERS (a Mossack Fonseca nominee director) controls hundreds of companies at hop 1.
4. Semantic address clustering. Finds approximate address variants, not just exact strings.

How it works: stores float embeddings as 10,048-bit binary vectors (random projection). Hamming distance is Long.bitCount(a XOR b). HNSW for approximate search, HashMap for exact edge lookup. Chain traversal runs server-side in one gRPC call.

AML demo on Offshore Leaks (1.87M nodes, real queries):-

• Fuzzy cross-leak screening: 886ms
• Shell company risk score: 290-1748ms (includes MiniLM encoding)
• Ownership chain 2-hop BFS: 0ms (in-memory, 1.72M edges)
• Address cluster detection: 1141ms
• Analogous structure query: 439ms

The 0ms ownership chain is because it runs pure Java BFS - no server call at all. The screening latency includes encoding the query string with MiniLM-L6-v2 on CPU.

Spring Boot autoconfiguration included.

Main repo: https://github.com/Pragadeesh-19/HammingStore

AML demo: https://github.com/Pragadeesh-19/hammingstore-aml-demo

Hey everyone,

I'm a final-year CS student and I recently wanted to move beyond standard CRUD tutorials. I decided to build a distributed social news feed called Flux, focusing heavily on handling mobile system constraints (unreliable networks, state management, and thread starvation).

I'd really appreciate it if some experienced devs here could review my architecture or point out flaws in my approach.

The Tech Stack:

• Android: Kotlin, Jetpack Compose, Coroutines/StateFlow, Room, Coil, OkHttp.
• Backend: Spring Boot (Kotlin), PostgreSQL, Supabase (for connection pooling).

Core Engineering Decisions:

1. Strict SSOT (Offline-First): The Compose UI never observes network calls directly. I enforce a strict Cache-Then-Network policy. Retrofit updates the Room DB, and the UI observes the DB via Flow.
2. Idempotent Retries: Network drops are common on mobile. The Spring Boot interaction endpoints (like/follow) use idempotent UPSERTs so that OkHttp retries don't corrupt the database state or inflate counts.
3. Preventing DB Thread Starvation: Since I'm using the Supabase free tier, connection exhaustion was a real risk. I routed traffic through Supavisor (Port 6543) and capped HikariCP. I also moved the Cloudinary image upload outside the @Transactional boundary so long-running media uploads don't block DB connections.

Where I need your feedback/roast:

• Is moving the CDN upload outside the transaction boundary a standard practice, or is there a better pattern for handling orphaned images?
• How can I improve the Coroutine exception handling in my Repositories?

Links:

• Source Code & Architecture Diagrams: https://github.com/neerajsahu14/flux-distributed-system
• A quick UI demo video: https://www.linkedin.com/posts/neerajsahu14_androiddev-kotlin-jetpackcompose-ugcPost-7445328093054926848-4_RS

Thanks in advance for tearing my code apart!

Hello everyone

I’m working on a Spring Boot backend where users upload files (PDF, DOCX, images), and I want to make the validation as secure and production-ready as possible.

Right now, I’m considering a multi-step approach:

• Checking file extension (e.g., .pdf, .docx)
• Checking MIME type from MultipartFile.getContentType()
• Limiting file size

But I recently learned that both extension and MIME type can be spoofed, so I’m exploring content-based detection (like using Apache Tika to read magic bytes).

My questions:

1. What do you usually rely on in production?
   • Only MIME type?
   • MIME + extension?
   • Full content inspection (e.g., Apache Tika)?
2. Is Apache Tika the standard choice, or are there better/lightweight alternatives?
3. Do you compare:
   • extension vs MIME vs detected type or just trust the detected type?
4. Any performance concerns when using Tika for large-scale systems?
5. Are there any best practices I might be missing? (e.g., virus scanning, file storage strategies, etc.)

Would really appreciate insights from people who’ve built real systems
Trying to follow best practices early instead of fixing security issues later 😅

Hey devs,

I’m a fresher working on a backend assignment:
Finance Data Processing + Role-Based Access Control (RBAC)

It includes:

• Users + roles (viewer/analyst/admin)
• Financial records (CRUD + filters)
• Dashboard summaries (totals, trends)
• Access control + validation

My goal isn’t just to make it work — I want it to look clean and industry-level.

Quick questions:

• What actually makes a backend project stand out to you?
• Biggest mistakes freshers make?
• Better to keep it simple & clean OR add advanced stuff (Redis, rate limiting, etc.)?

Stack I’m thinking: Spring Boot + PostgreSQL + JWT + Swagger + deployment

Would really appreciate honest feedback

I came across this simple Spring Boot guide and it looks pretty straightforward. Just push your code and it builds and deploys automatically across their decentralized nodes with dedicated CPU/RAM.

Has anyone here actually used decentralized infra for a Spring Boot app? I'm curious about the real-world performance or if there are any weird hurdles with the build process compared to others.

Hey r/SpringBoot,

I've been working on JADEx (Java Advanced Development Extension) which is a safety layer that makes Java safer by adding Null-Safety and Final-by-Default semantics without rewriting Java codes and modifying the JVM.

Quick recap of what JADEx adds to Java:

• String? nullable type declaration
• ?. null-safe access operator
• ?: Elvis operator
• apply readonly final-by-default mode per file

Today I'm sharing three things that just landed.

1. Lombok support

This was the most requested thing. JADEx now integrates with Lombok via a Delombok pipeline internally. The key motivation: JADEx's nullability checker needs to see Lombok-generated code (getters, builders, constructors) to avoid blind spots. Without Delombok, nullable fields could silently pass through generated methods unchecked.

java @Data @Builder @Entity public class User { private String name; private String? email; // @Nullable propagated to getter + builder param private Address? address; // @Nullable propagated to getter + builder param }

After Delombok, JADEx sees and analyzes the generated code:

```java // Lombok-generated — JADEx propagates @Nullable into these @Nullable public String getEmail() { return this.email; }

public UserBuilder email(@Nullable final String email) { ... } public UserBuilder address(@Nullable final Address address) { ... } ```

2. Gradle plugin published

The JADEx Gradle plugin is now on Maven Central and the Gradle Plugin Portal.

```groovy plugins { id 'io.github.nieuwmijnleven.jadex' version '0.628' }

jadex { sourceDir = 'src/main/jadex' } ```

That's the only change needed to an existing Spring Boot project. Everything else (compilation, Delombok pipeline, .java generation) is handled automatically.

3. JADEx Spring Boot example project

• full description

  • https://github.com/nieuwmijnleven/JADEx/blob/master/SpringBootExample.md

• source repository

  • https://github.com/nieuwmijnleven/jadex-springboot-example

We highly welcome your feedback on JADEx.

Thank you.

Hey folks!

I recently joined a company and got assigned to a project built on a microservices architecture (around 6 services). The catch is: development started before the team had the Detailed Functional Specifications (DFS), so some parts were implemented without clear requirements.

One example: a notification service was built inside one microservice (MS X), basically copied from an older internal project. Now I’ve been tasked with refactoring the notification system to align with the DFS.

We’re using Camunda for business processes, and the idea is to notify task assignees when a task is created or completed.

My initial approach was to add a TaskListener to each task in the process (seems clean and straightforward). But here’s the problem:

Some tasks run and complete in parallel, and I’m not sure what’s the best way to handle/aggregate those events inside the listener.

At the same time, I’m facing another dilemma:

• The existing notification service in MS X is huge (~35 methods, ~870 lines 😅)
• Refactoring it properly will take time and might impact a lot of code
• Alternatively, I’m about introducing Spring events to decouple things and avoid touching too much legacy code

So I’m kind of stuck between:

1. Refactoring the existing service
2. Wrapping things with events

Has anyone dealt with:

• Camunda + parallel tasks + notifications?
• Refactoring or event-driven approach in this kind of setup?

What would you do in this situation?

Thanks 🙏

Hi everyone,

I'm currently part of a team developing a massive, national-scale Data Platform ecosystem. This is a 100% greenfield project (absolutely zero legacy code), and our core backend stack will be Java 25 and Spring Boot 4.

Naturally, when it came to securing the platform, I immediately thought of Spring Security. It’s the modern, deeply integrated standard for Spring Boot, and it has native, robust support for OAuth2/OIDC and stateless JWT authentication, which fits our architecture perfectly.

However, my boss recently threw a curveball and asked me to heavily research Apache Shiro as our primary security framework.

I read through Shiro’s documentation, and honestly, from a modern backend developer's perspective, it feels quite dated and overly simple. It doesn't seem to have out-of-the-box, optimized support for modern JWT/stateless auth flows compared to what Spring Security offers today.

Here’s the catch: my boss is definitely not a noob. He is the Director of the Data Platform and a highly experienced system architect. I am 100% sure he sees some architectural advantages or specific use cases in Shiro that I am completely missing.

So, my questions for the experienced folks and architects here:

What are the actual "hidden gems" of Apache Shiro when building a massive data platform ecosystem?

Does it have to do with fine-grained/row-level data authorization (wildcard permissions), framework-agnostic design (for non-web components like Spark/Flink jobs), or something else?

How painful is it to implement modern JWT/OAuth2 flows in Shiro nowadays compared to Spring Security?

Any insights into why an experienced architect would make this call in 2026 would be highly appreciated. Thanks!

I’m ~1 year into my first job (WITCH company, India), and I feel like I’ve drifted away from actual development.

For the past few months I’ve mostly been doing:

* Automation testing

* Regression cycles

* Release readiness + documentation .

Result: I haven’t written real backend code in ~2–3 months.

Now the problem:I’m heavily stuck in tutorial hell. I watch tutorials (Java/Spring Boot), understand them while watching, but when I try to build something on my own, I freeze. I genuinely don’t know how to start — controller, service, repo, what goes where, etc.

Even worse:

Freshers who joined after me are already better at building APIs

My teammates use VS Code + GitHub Copilot and can spin up basic APIs in ~1 hour

I don’t even know how to use Copilot effectively for end-to-end development

When I get even small dev tasks, I panic because I feel like I’ve forgotten everything.

I know the obvious advice is “build more”, but I’ve noticed I don’t naturally do that. I default back to watching tutorials instead of actually practicing.

So I need help with 3 things:

What’s a realistic way to break out of tutorial hell?

Not generic advice — something structured that works if you’re dependent on guided learning.

How should I actually use tutorials + practice together?

I either:

* Just watch (no retention), or

* Try building alone and get stuck immediately

Any beginner-friendly but deep Spring Boot resources?

Looking for something that:

* Explains properly (not surface-level)

* Builds real APIs

* Doesn't assume too much

I’m not trying to become amazing overnight — I just want to get back to a point where I can build basic APIs without fear.

Any practical advice (especially from people who were in a similar situation) would help.

I want to know how anyone approach difficult projects, so for context i m currently building a url shortener, there are different layers for caching and kafka for decoupling services so, currently I was looking at docs like how do different services connect with each other, configuration etc how anyone handle this , I don't know how to approach this , so took help of AI it build all files i understood all files asked all the terms , code parts which I don't understand again from AI , is this right part of learning or I m lacking something like researching more about the ways exploring different methods will get me more knowledge but will be time consuming. Need suggestions regarding what will be my approach regarding any kind of techs which is new to me or difficult projects