#SpringBoot : Tutorial Part 3 (Basic Spring Boot Project)

ALSO CHECK: #SpringBootTutorial

In the part 1 of #SpringBoot tutorial we got the gist of the Spring Boot, in part 2 we discussed dependency injection. Now in this tutorial we will create a basic Spring Boot project from scratch.

You can STS (Spring Tool Suite) to create the project. STS is an Eclipse-based development environment. It is an IDE to develop Spring applications. It provides a ready-to-use environment to implement, run, deploy, and debug the application.

You can download the Spring Tool Suite from https://spring.io/tools3/sts/all. It's pretty simple to install.

#SpringBoot : Tutorial Part 2 (Dependency Injection)

ALSO CHECK: #SpringBootTutorial

In the previous tutorial we got the gist of the Spring Boot. Before proceeding further let's discuss Dependency Injection.

What is Dependency Injection (DI)?

When writing a complex Java application, application classes should be as independent as possible of other Java classes to increase the possibility to reuse these classes and to test them independently of other classes while doing unit testing. Dependency Injection helps in gluing these classes together and keeping them independent at the same time.

Dependency Injection design pattern allows us to remove the hard-coded dependencies and make our application loosely coupled, extendable and maintainable. 

#SpringBoot : Tutorial Part 1

ALSO CHECK: #SpringBootTutorial

In this tutorial we will have some basic theoretical knowledge about Spring Boot.

What is Spring Boot?

• Spring Boot is not a framework, it is a way to create stand-alone applications with minimal or zero configurations.
• With Spring Boot we can develop spring based applications with very less configuration. It provides defaults for code and annotation configuration to quickly start new spring projects within no time.
• It is a Spring module that provides the RAD (Rapid Application Development) feature to the Spring Framework. It comes with the auto-dependency resolution, embedded HTTP servers, auto-configuration, management endpoints and Spring Boot CLI.
• SpringBoot uses convention over configuration software design paradigm, that's why in SpringBoot we don't have XML configuration (deployment descriptor) or beans defined with @Configuration. It had embedded HTTP servers. In short we can say Spring Boot is the combination of Spring Framework and Embedded Servers.

Difference between Spring's @RequestParam vs @PathVariable

ALSO CHECK: Spring Interview Questions

What is the difference between Spring's @RequestParam vs @PathVariable Annotations.
Let's first understand the purpose and usage of @RequestParam and @PathVariable.

@RequestParam annotation is used to get the request parameters from URI, also known as query parameters. e.g If we have an incoming request with order id – http://scrutinybykhimaanshu.com/posts?postId=72

Then we can read the get the postId, using @RequestParam like below

@RequestMapping("/posts")
public String getPostDetails(@RequestParam("postId") String postId) {
  return "postDetails";
}

The required=false can be used to make the query parameter optional. e.g

@RequestMapping("/posts")
public String getPostDetails(@RequestParam(value="postId", required=false) String postId) {
  return "postDetails";
}

How to use YAML with Spring Boot?

ALSO CHECK: Spring Interview Questions

What is YAML?
YAML stands for 'YAML Ain’t Markup Language'.

It is a human friendly data serialization standard for all programming languages. It is a superset of JSON, and as such is a very convenient format for specifying hierarchical configuration data.

YAML is more readable and it is good for the developers for read/write configuration files.

Spring Security-Part 4.3: Form Based Authentication

> > Previous Tutorial: Spring Security-Part 4.2

Form Based Authentication

• When we do basic authentication, we need to pass 'Authorization' in header (e.g, Authentication:Basic BASE_64_UserName:Password). Though the basic auth is simple and fast, it has one disadvantage that we can't logout.
• We can user form based authentication, in which user will enter user name and password and can logout whenever required.

To switch from Basic to Form based authentication, we need to update ApplicationSecurityConfig. In the configure() method instead of httpBasic(), we need to use formLogin().

Spring Security-Part 4.2: @PreAuthorize, @PostAuthorize, @Secured, @RoleAllowed, @EnableGlobalMethodSecurity annotations

< < Previous Tutorial : Spring Security-Part 4.1

Annotation Based Roles and Authorities/Permissions

In our previous tutorial we had configured the roles and authorities in ApplicationSecurityConfig (which extends WebSecurityConfigurerAdapter). We can do the same thing by using @PreAuthorize annotation.

Spring Security-Part 4.1: Spring Security

Let's create a new project from Spring Initializr https://start.spring.io/.

• Project: Maven Project
• Language: Java
• Spring Boot: 2.2.4
• Group: com.example
• Artifact: spring-security-demo
• Java Version: 8
• Dependencies: Spring Web

Generate the project and import it in either Eclipse/STS or IntelliJ.

Spring Security-Part 3 : Spring Security with JPA authentication and MySQL

Example of Spring Security with JPA authentication and MySQL
We will build a Spring boot project with Spring Security that will do database authentication using JPA and connect with MYSQL database.

Let's say we have a mysql database locally with database instance with name 'springsecurity'. This database has a table with a name 'user'. 'roles' has comma separated roles.

#SpringSecurity Part 3 : Spring Security Flow

In the Part 1 of #SpringSecurity tutorial, we learned the difference between Authentication and Authorization. In Part 2, we created a Basic Authentication implementation was explained.

In this section, we will understand Spring Security Flow.

Above diagram show, how Spring Security works internally.

#SpringSecurity Part 2 : Securing Web-services with Spring (Basic, In-Memory and JDBC Authentication)

ALSO CHECK: Spring Interview Questions and Answers

How can we implement basic authentication in Spring?
For this let us create a Spring Starter Project titled 'BasicAuthentication' from STS, this project has only Spring Web dependency.

#SpringSecurity Part 2 : Creating a simple Spring security project (Basic Authentication)

In the Part 1 of #SpringSecurity tutorial, I explained the difference between Authentication and Authorization. Now let's see how can we implement basic authentication in Spring.

#SpringSecurity Part 1 : Authentication v/s Authorization

ALSO CHECK: Spring Interview Questions and Answers

Authentication and Authorization are often used in conjunction with each other in terms of security, especially when it comes to gaining access to the system. 

Authentication means confirming your own identity, while authorization means granting access to the system. We can say, authentication is the process of verifying who you are, while authorization is the process of verifying what you have access to.

What is API Gateway?

ALSO CHECK: Microservices Interview Questions And Answers

What is the API Gateway pattern?
Let's start with the use case. Assume we are developing an application, where users can purchase the products. Here is the list of web-services available:

• /home
• /productdetails
• /productdetails/add
• /productdetails/delete
• /cartdetails/get
• /cartdetails/add

HATEOAS and Richardson Maturity Model

ALSO CHECK: Microservices Interview Questions And Answers

The Richardson Maturity Model (RMM) is a model developed by Leonard Richardson that helps organize your REST APIs into four levels.  It is proposed by Leonard Richardson. Here are the four levels of RMM:

• Level 0: The Swamp of POX
• Level 1: Resources
• Level 2: HTTP Verbs
• Level 3: Hypermedia Control

Part 17: Microservices (CQRS and Event Sourcing)

ALSO CHECK: Microservices Interview Questions And Answers

Event Sourcing
A shared database is not recommended in a microservices-based approach, because, if there is a change in one data model, then other services are also impacted. As part of microservices best practices, each microservice should have its own database.

Let's say you have Customer and Order microservices running in their seprate containers. While the Order service will take care of creating, deleting, updating, and retrieving order data, the Customer service will work with customer data.

Part 16: Microservices (Implementing Circuit Breaker and Bulkhead patterns using Resilience4j)

ALSO CHECK: Microservices Interview Questions And Answers

Circuit Breaker Pattern
Circuit breaker is a resilience pattern. This pattern help prevent cascading failures. A circuit breaker is used to isolate a faulty service, it wraps a fragile function call (or an integration point with an external service) in a special (circuit breaker) object, which monitors for failures. Once the failures reach a certain threshold, the circuit breaker trips, and all further calls to the circuit breaker return with an error, without the protected call being made at all.

ALSO READ: Part 6: Microservices (Fault Tolerance, Resilience, Circuit Breaker Pattern)

Part 15: Microservices (Saga Pattern)

ALSO CHECK: Microservices Interview Questions And Answers

Observability
Every application relies on data and the success or failure of any business relies on efficient data management.

Data Management in a monolithic system can get pretty complex. However, it could be a completely different if you are using Microservices architecture.

Here are a couple of data management patterns for microservices:

• Database per Service - each service has its own private database
• Shared database - services share a database
• Saga - use sagas, which a sequences of local transactions, to maintain data consistency across services
• API Composition - implement queries by invoking the services that own the data and performing an in-memory join
• CQRS - implement queries by maintaining one or more materialized views that can be efficiently queried
• Domain event - publish an event whenever data changes
• Event sourcing - persist aggregates as a sequence of events

Part 14: Microservices (Observability Patterns)

ALSO CHECK: Microservices Interview Questions And Answers

Observability

• Log aggregation - aggregate application logs
• Application metrics - instrument a service’s code to gather statistics about operations
• Audit logging - record user activity in a database
• Distributed tracing - instrument services with code that assigns each external request an unique identifier that is passed between services. Record information (e.g. start time, end time) about the work (e.g. service requests) performed when handling the external request in a centralized service
• Exception tracking - report all exceptions to a centralized exception tracking service that aggregates and tracks exceptions and notifies developers.
• Health check API - service API (e.g. HTTP endpoint) that returns the health of the service and can be pinged, for example, by a monitoring service
• Log deployments and changes

Part 13: Microservices (Deployment Patterns)

ALSO CHECK: Microservices Interview Questions And Answers

Deployment Patterns

• Multiple service instances per host - deploy multiple service instances on a single host
• Service instance per host - deploy each service instance in its own host
• Service instance per VM - deploy each service instance in its VM
• Service instance per Container - deploy each service instance in its container
• Serverless deployment - deploy a service using serverless deployment platform
• Service deployment platform - deploy services using a highly automated deployment platform that provides a service abstraction