Web services with Spring Boot
You build a Spring Boot service with validated REST endpoints, database access and authentication that is observable and runs with secure defaults.
Level 301 · 19 lessons · 15 practice labs
Lessons
Getting started
- A Spring Boot project and auto-configuration
- Beans and dependency injection
- REST controllers and response codes
- Input validation with Bean Validation
- Central error handling: ControllerAdvice and ProblemDetail
- Short task: a support ticket API
Data and configuration
- Spring Data JPA repositories
- Profiles, configuration properties and secrets
- The mass-assignment mistake and using DTOs
- Slice tests: WebMvcTest and DataJpaTest
- Short task: move tickets into the database and test them
Security and operations
- Spring Security: the authentication chain
- Role and ownership-based authorisation
- Getting CSRF and CORS settings right
- Actuator: health endpoints and what must not be exposed
- Metrics, trace IDs and logs
- Packaging and running securely
- Short task: lock down the endpoints left open
Capstone
- Capstone: an asset management service with role-based access
Practice labs
- Writing a REST endpoint for a support ticket: Write a controller that returns a ticket by id, answering 404 when missing and 201 with a Location header on creation.
- Converting field injection to constructor injection: Convert field injection and dependencies built with new to constructor injection so the service test runs without a Spring context.
- Solving a bean ambiguity and scope bug: Fix an application that fails to start because of two implementations of one interface and mixes users up by keeping request data in a singleton bean.
- Validating a request body with Bean Validation: Add not-blank, length and e-mail constraints to the create request and test that an invalid request gets 400.
- Turning errors into ProblemDetail in a central handler: Replace scattered try-catch blocks with a ControllerAdvice returning a ProblemDetail that lists field errors and leaks no stack trace.
- A custom validator for a cross-field rule: Write a class-level custom constraint checking the end date is after the start, bind the message to the right field and apply a different rule on update with validation groups.
- Adding a derived query to a Spring Data repository: Add a derived query method returning tickets by status and date in pages and verify it with DataJpaTest.
- Organising profiles and configuration properties: Gather scattered Value uses into a validated configuration class, separate development and production profiles and take the secret from the environment.
- Closing a mass-assignment bug with DTOs: Fix an endpoint where role and owner fields can be changed because the entity is bound straight to the request body using input and output DTOs, and prove it with WebMvcTest.
- Protecting endpoints in the security chain: Write a security chain that leaves the health endpoint open and ties every other path to authentication.
- Role and ownership-based authorisation: Close access to someone else's record in Lavinya Klinikleri's appointment API with a method-level ownership check, exempt the admin role and verify by test.
- Getting CSRF and CORS settings right: Fix a configuration that disabled CSRF entirely and allows every origin so session forms are protected, only the known origin is allowed and endpoints left open are closed.
- Exposing only what is needed in Actuator: Limit a setting that exposes every Actuator endpoint to health and info and test that the environment and heap dump endpoints are closed.
- Adding trace ids, logs and metrics: Assign a trace id to each request, carry it on log lines and add custom metrics for ticket creation count and duration.
- Packaging and running the application securely: Package the application as an executable JAR and run it as an unprivileged user with graceful shutdown on and secrets supplied from outside, showing an in-flight request completes on shutdown.
About this course
You build a Spring Boot service with validated REST endpoints, database access and authentication that is observable and runs with secure defaults.
What you will learn
- Getting started
- Data and configuration
- Security and operations
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.