Spring-Boot

Google “Spring Boot JWT tutorial” and the top results still hand you the 2019 recipe: a custom OncePerRequestFilter that parses the Authorization header by hand, a third-party JWT library, a UserDetailsService, and five config classes of glue. It works — the way a hand-rolled ORM works. On Spring Boot 4, Spring Security 7 has first-class JWT support through the built-in OAuth2 Resource Server. No custom filter. No third-party JWT library. Here’s the modern shape, including what Security 7 removed out from under the old tutorials. ...

Every Spring codebase has its own API versioning story, and they’re all slightly embarrassing: /v1 and /v2 prefixes baked into paths, a custom header parsed by hand in an interceptor, or two parallel controller classes that drift out of sync. Spring Framework 7 — the foundation of Spring Boot 4 — finally makes versioning a first-class citizen: a version attribute on @RequestMapping and every shortcut variant, with the framework handling resolution, matching, and deprecation. Here’s how to use it, and where it bites. ...

Migrating one service to Spring Boot 4 is a weekend project. Migrating sixty is a program — and programs fail in a specific way: every team independently rediscovers the same seven errors, burns a week each, and the “migration” becomes sixty snowflake upgrades with sixty subtly different outcomes. The fix is a discipline with an unfriendly name and a friendly result: solve every error once. When a team hits a migration error, the output isn’t a fixed service — it’s a permanent, automated fix that no other team ever has to think about again. Here’s the playbook. ...

The symptom is always the same: heap usage climbs a little every day, GC reclaims less and less, and eventually someone sets a cron to restart the service at 3 AM. The heap dump shows nothing obviously wrong — no giant cache, no runaway collection. Just thousands of ordinary objects that should have died with their requests, all reachable through one path: Thread → ThreadLocalMap → Entry. This is the ThreadLocal leak, and it’s the quietest memory leak in Java. ...

Every message-driven system eventually meets its poison message: one malformed payload, one downstream bug, one record that will never process successfully — retried forever, burning CPU, and in the worst designs blocking every message queued behind it. The dead letter queue is the answer, but “just add a DLQ” hides three decisions: how many attempts before giving up, what counts as an attempt, and who gets woken up when something lands in the DLQ. Get any of them wrong and the DLQ is theater. ...