Best practices for building Spring Boot applications in Java. Use when developing REST APIs, configuring dependency injection, setting up JPA repositories, implementing security with Spring Security, writing integration tests with @SpringBootTest, or structuring a Spring Boot project. Covers controllers, services, configuration, profiles, and testing.
Best practices for building Spring Boot applications in Java. Use when developing REST APIs, configuring dependency injection, setting up JPA repositories, implementing security with Spring Security, writing integration tests with @SpringBootTest, or structuring a Spring Boot project. Covers controllers, services, configuration, profiles, and testing.
Spring Boot Best Practices
Project Setup & Structure
Build Tool: Use Maven (pom.xml) or Gradle (build.gradle) for dependency management.
Starters: Use Spring Boot starters (e.g., spring-boot-starter-web, spring-boot-starter-data-jpa) to simplify dependency management.
Package Structure: Organize code by feature/domain (e.g., com.example.app.order, com.example.app.user) rather than by layer (e.g., com.example.app.controller, com.example.app.service).
Dependency Injection & Components
Constructor Injection: Always use constructor-based injection for required dependencies. This makes components easier to test and dependencies explicit.
Immutability: Declare dependency fields as private final.
Component Stereotypes: Use @Component, @Service, @Repository, and @Controller/@RestController annotations appropriately to define beans.
Configuration
Externalized Configuration: Use application.yml (or application.properties) for configuration. YAML is often preferred for its readability and hierarchical structure.
Type-Safe Properties: Use @ConfigurationProperties to bind configuration to strongly-typed Java objects.
Profiles: Use Spring Profiles (application-dev.yml, application-prod.yml) to manage environment-specific configurations.
Secrets Management: Do not hardcode secrets. Use environment variables, or a dedicated secret management tool like HashiCorp Vault or AWS Secrets Manager.
Web Layer (Controllers)
RESTful APIs: Design clear and consistent RESTful endpoints.
DTOs (Data Transfer Objects): Use DTOs to expose and consume data in the API layer. Do not expose JPA entities directly to the client.
Validation: Use Java Bean Validation (JSR 380) with annotations (@Valid, @NotNull, @Size) on DTOs to validate request payloads.
Error Handling: Implement a global exception handler using @ControllerAdvice and @ExceptionHandler to provide consistent error responses.
Service Layer
Business Logic: Encapsulate all business logic within @Service classes.
Statelessness: Services should be stateless.
Transaction Management: Use @Transactional on service methods to manage database transactions declaratively. Apply it at the most granular level necessary.
Data Layer (Repositories)
Spring Data JPA: Use Spring Data JPA repositories by extending JpaRepository or CrudRepository for standard database operations.
Custom Queries: For complex queries, use @Query or the JPA Criteria API.
Projections: Use DTO projections to fetch only the necessary data from the database.
Logging
SLF4J: Use the SLF4J API for logging.
Logger Declaration:private static final Logger logger = LoggerFactory.getLogger(MyClass.class);
Parameterized Logging: Use parameterized messages (logger.info("Processing user {}...", userId);) instead of string concatenation to improve performance.
Testing
Unit Tests: Write unit tests for services and components using JUnit 5 and Mockito. Use the java-junit skill for detailed testing conventions.
Integration Tests: Use @SpringBootTest for integration tests that load the Spring application context.
Test Slices: Use test slice annotations like @WebMvcTest (for controllers) or @DataJpaTest (for repositories) to test specific parts of the application in isolation.
Testcontainers: Consider using Testcontainers for reliable integration tests with real databases, message brokers, etc.
Documentation: Use the java-docs skill to add Javadoc to public APIs.
Security
Spring Security: Use Spring Security for authentication and authorization.
Password Encoding: Always encode passwords using a strong hashing algorithm like BCrypt.
Input Sanitization: Prevent SQL injection by using Spring Data JPA or parameterized queries. Prevent Cross-Site Scripting (XSS) by properly encoding output.
