Spring Boot Tutorials

Spring Boot 4 from the ground up — beans and dependency injection, REST APIs, JPA and JdbcTemplate, security and JWT, caching, messaging and testing, every example lifted from a real pizza ordering API.

• Spring Boot – Interview Questions
  Senior-level questions and answers, every one drawn from a real decision or a real bug in the pizza codebase rather than from a list. Auto-configuration, bean scopes, the proxy rule, transactions, N+1, stateless auth, and the trade-offs an interviewer is actually listening for.
• Spring Boot – Cheat Sheet
  The annotations and snippets from this whole track in one page, grouped by what you are trying to do — wire a bean, expose an endpoint, query a database, secure a route, cache a result, schedule a job. Written to be scanned rather than read, with a link to the lesson behind each one.
• Spring Boot – Building with Gradle
  The same pizza backend built with Gradle instead of Maven — the plugins, the dependency management, annotation processors for Lombok and MapStruct, and the wrapper. Side by side with the pom.xml it replaces, so you can read either build file and know what the other one says.
• Spring Boot – Testing
  The test pyramid as Spring Boot expresses it: a plain unit test with Mockito, a @WebMvcTest slice, a @DataJpaTest slice, and @SpringBootTest for the cases that genuinely need the whole context. Testing secured endpoints, and why the slice you reach for first should be the smallest one that fails honestly.
• Spring Boot – Sending Email
  JavaMailSender, a MimeMessageHelper for HTML and attachments, and rendering the body from the Thymeleaf template built earlier in the track. Sending it off the request thread, and testing the whole thing against a local sink instead of a real inbox.
• Spring Boot – Messaging with JMS
  Handing work to a queue so the request can return. JmsTemplate, @JmsListener, converting a message payload to JSON, and what to do with a message that keeps failing — because without a dead-letter destination it is redelivered forever.
• Spring Boot – Retries
  @Retryable with exponential backoff and a @Recover fallback, applied to the Stripe calls in the pizza API. Which exceptions are worth retrying and which just waste time, and the correctness rule underneath all of it: retrying a non-idempotent call is how you charge a customer twice.
• Spring Boot – Async Work and Thread Pools
  @EnableAsync, @Async and a ThreadPoolTaskExecutor sized on purpose rather than left at the default. What the queue and rejection policy actually do under load, @Scheduled for recurring work, and why an @Async method that returns void throws away its own exceptions.
• Spring Boot – OAuth2
  The authorization code flow in the terms Spring actually names things, sign in with Google against the pizza app, and the piece every tutorial skips: reconciling an OAuth2 identity with the user row you already have, so the same person logging in both ways does not end up as two accounts.
• Spring Boot – Method-Level Security
  @PreAuthorize, @PostAuthorize and @Secured, and why URL rules alone stop being enough as soon as two entry points reach the same service. Expression-based checks against the authenticated principal, and the proxy rule that makes an internal call skip the check entirely.
• Spring Boot – Stateless API Authentication with JWT
  Issuing a token at login, validating it in a OncePerRequestFilter, and putting the result in the SecurityContext. Where the signing key comes from, what does and does not belong in a claim, and the honest trade-off nobody mentions: a stateless token cannot be revoked.
• Spring Boot – Configuring the Security Filter Chain
  The modern lambda DSL — WebSecurityCustomizer is gone and so is WebSecurityConfigurerAdapter. Ordering rules so a permitAll does not accidentally open an admin endpoint, disabling CSRF only where it is genuinely safe to, and making CORS and security agree instead of fighting.
• Spring Security – How Authentication Works
  The filter chain, AuthenticationManager, UserDetailsService and the SecurityContext — the four pieces everything else in Spring Security is built on. Password hashing with BCrypt, and why a login failure should be deliberately vague about which half of the credentials was wrong.
• Spring Boot – Elasticsearch
  Full-text search that a LIKE query cannot do. Spring Data Elasticsearch repositories, mapping a document, keeping the index in step with the database, and being honest about the operational cost — this is the point where the demo app stops needing only MySQL.
• Spring Boot – Caching
  @EnableCaching, @Cacheable, @CacheEvict and the key generation you almost always want to override. Caching the menu in the pizza API, why an eviction has to be wired to every write path that can invalidate it, and the same proxy rule AOP has: a self-invocation is never cached.
• Spring Boot – Lombok
  The annotations worth using — @Getter, @Setter, @RequiredArgsConstructor, @Builder, @Slf4j — and the two to be careful with: @Data on a JPA entity generates an equals and hashCode that break the moment the entity is in a HashSet, and @ToString will happily log a password field.
• Spring Boot – Mapping DTOs with MapStruct
  Generated mapping code instead of hand-written getters and setters, checked at compile time. Writing a mapper, handling nested objects and custom expressions — and the annotation-processor ordering that makes MapStruct and Lombok work together, because getting it wrong produces mappers that compile and map nothing.
• Spring Boot – Schema Migrations with Liquibase
  Let the database schema live in version control. Changelogs, changesets and the checksum that makes editing an applied migration a mistake you only make once. Pairing Liquibase with ddl-auto=validate so drift fails at boot, and the Boot 4 starter you need or Liquibase silently never runs at all.
• Spring Boot – JdbcTemplate
  When JPA has nothing to offer — aggregates, reports, any query whose result is not an entity. NamedParameterJdbcTemplate, RowMappers in their own testable classes, and the trap that silently inflated a revenue report: hand-written SQL never sees the @SQLRestriction that hides deleted rows.
• Spring Boot – JPA and Hibernate
  Entities, relationships and the persistence context. Lazy loading and the N+1 query it hands you, why open-in-view is switched off here, soft deletes with @SQLRestriction, and the ddl-auto setting to use once something other than Hibernate owns your schema.
• Spring Boot – Server-Rendered Pages with Thymeleaf
  Not every page needs a JavaScript framework. A @Controller that returns a view name, the Thymeleaf syntax worth knowing, layout fragments, and rendering the same template to a string for an email body. Includes when to reach for this instead of a REST endpoint, and when not to.
• Spring Boot – API Docs with springdoc-openapi
  Springfox is dead; springdoc is what generates OpenAPI 3 from your controllers now. Wiring it up, documenting an endpoint properly, describing JWT auth so the Try It Out button works — and the version pin Boot 4 forces on you, because Boot no longer manages springdoc's version.
• Spring Boot – File Upload
  Accepting a MultipartFile, the size limits you have to raise in two different places, and validating what was actually uploaded rather than trusting the filename or the content type the browser claimed. Ends with streaming a file back out again.
• Spring Boot – Exception Handling
  One @RestControllerAdvice, one error shape, every endpoint. Turning a validation failure into a field-by-field response the frontend can render, mapping your own exceptions to status codes, and why returning 404 instead of 403 for a foreign-owned resource is a security decision rather than a sloppy one.
• Spring Boot – Building a REST API
  @RestController end to end: path and query binding, request bodies, Bean Validation, and returning the right status code instead of 200 for everything. Why the pizza API exposes a UUID rather than its primary key, and why a DTO is not ceremony once an entity has a password field on it.
• Spring Boot – Spring Web MVC
  How a request actually reaches your method: DispatcherServlet, handler mapping, argument resolvers and message converters. Where CORS is configured and why it has to agree with the security filter chain, and what Boot 4's webmvc starter gives you before you write a line.
• Spring Boot – Application Events
  Publishing an event instead of calling four services. @EventListener, ordering, async listeners, and @TransactionalEventListener — because a listener that fires before the transaction commits will happily email a customer about an order that is about to be rolled back.
• Spring Boot – Aspect-Oriented Programming
  Cross-cutting concerns without copying the same five lines into forty methods. Pointcuts, @Around advice and a real timing aspect over the service layer — plus the proxy rule that catches everyone: a self-invocation inside the same class never goes through the proxy, so the aspect simply does not run.
• Spring Boot – Configuration, Profiles and Properties
  Where configuration comes from and which source wins, @Value versus @ConfigurationProperties and why typed records beat scattered strings, profiles for local versus production, and how to keep secrets out of the repository without making the app impossible to run.
• Spring Boot – Dependency Injection
  Inversion of control in the only form that matters day to day: constructor injection. Why field injection with @Autowired is the wrong default, how Lombok's @RequiredArgsConstructor removes the boilerplate that made people reach for it, and how to break a circular dependency instead of papering over it with @Lazy.
• Spring Boot – Beans, Scopes and Lifecycle
  What a bean is, the difference between @Component and @Bean and when you need the second one, singleton versus prototype scope, the callbacks that run as a bean is created and destroyed, and why @Primary and @Qualifier exist the moment two beans satisfy the same type.
• Spring Boot – Structuring a Project
  Package by feature, not by layer. The controller / service / DAO split the pizza API uses, why every service and DAO is an interface plus an implementation, where DTOs and mappers live, and why component scanning makes the application class's package the one structural decision you cannot get wrong.
• Spring Boot – Migrating from Spring, and from Boot 3 to 4
  What XML configuration, a WAR file and a servlet container turn into once Boot is doing the work. Then the migration people actually face today: Boot 3 to Boot 4, where the modularised starters mean a dependency that used to bring autoconfiguration with it now silently brings none.
• Spring Boot – What It Actually Does
  Starters, auto-configuration and the embedded server — the three things that separate Spring Boot from plain Spring. Why one dependency drags in twelve, how Boot decides which beans to create for you, and how to see every decision it made with the condition evaluation report.
• Spring Boot – Get Started
  Start here. What Spring Boot is and what problem it solves, the exact versions this track is written against — Spring Boot 4.1 on Java 21 — one command to generate a project and see it running, the pizza ordering API every example is taken from, and the full lesson index in reading order.