Spring Framework in Java: The Complete Guide for Developers

public class UserDTO {

    private String username;
    private String email;
    private String password;

    // Getters and Setters
    public String getUsername() {
        return username;
    }

    public String getEmail() {
        return email;
    }

    public String getPassword() {
        return password;
    }
}

@Service
public class UserService {

    private static final Logger logger = LoggerFactory.getLogger(UserService.class);

    // Dummy in-memory storage
    private final Map<String, UserDTO> userStore = new HashMap<>();

    public String registerUser(UserDTO userDTO) {
        userStore.put(userDTO.getUsername(), userDTO);
        logger.info("User registered: {}", userDTO.getUsername());
        return "User '" + userDTO.getUsername() + "' registered successfully!";
    }

    public UserDTO findByUsername(String username) {
        logger.info("Finding by username: {}", username);
        return userStore.get(username);
    }
}

@RestController
@RequestMapping("/api/users")
public class UserController {

    @Autowired  // Field injection
    private UserService userService;

    /*
    @Autowired  // constructor injection (recommended)
    public UserController(UserService userService) {
      this.userService = userService;
    }
    */

    /**
     * Register a new user via POST
     * Example: POST /api/users/register
     */
    @PostMapping("/register")
    public String registerUser(@RequestBody UserDTO userDTO) {
        return userService.registerUser(userDTO);
    }

    /**
     * Get user by query param
     * Example: GET /api/users/find?username=srimanta
     */
    @GetMapping("/find")
    public UserDTO getUserByQueryParam(@RequestParam String username) {
        return userService.findByUsername(username);
    }

    /**
     * Get user by path variable
     * Example: GET /api/users/srimanta
     */
    @GetMapping("/{username}")
    public UserDTO getUserByPath(@PathVariable String username) {
        return userService.findByUsername(username);
    }
}

<!-- Maven -->
<!-- JSON (comes with Spring Boot Starter Web) -->
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
</dependency>

<!-- XML support -->
<dependency>
    <groupId>com.fasterxml.jackson.dataformat</groupId>
    <artifactId>jackson-dataformat-xml</artifactId>
</dependency>

@JacksonXmlRootElement(localName = "user")
public class UserDTO {

    @NotBlank(message = "Username is required")
    @Size(min = 3, max = 20, message = "Username must be between 3 and 20 characters")
    @JsonProperty("username")
    private String username;

    @Email(message = "Invalid email format")
    @JsonProperty("email")
    private String email;

    @NotBlank(message = "Password is required")
    @Size(min = 6, message = "Password must be at least 6 characters")
    @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)  // excluded from response (serialization)
    private String password;

    // Constructors
    public UserDTO() {
    }

    public UserDTO(String username, String email, String password) {
        this.username = username;
        this.email = email;
        this.password = password;
    }

    // Getters and Setters
    public String getUsername() {
        return username;
    }

    public String getEmail() {
        return email;
    }

    public String getPassword() {
        return password;
    }
}

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Override
    public void extendMessageConverters(List<HttpMessageConverter<?>> converters) {
        // JSON converter
        converters.add(new MappingJackson2HttpMessageConverter(new ObjectMapper()));

        // XML converter
        converters.add(new MappingJackson2XmlHttpMessageConverter(new XmlMapper()));
    }
}

@RestController
@RequestMapping("/api/users")
@Validated // Enables method-level validation (useful for path variables, service params, etc.)
public class UserController {

    @Autowired  // Field injection
    private UserService userService;

    /**
     * Register a new user via POST
     * Example: POST /api/users/register
     */
    @PostMapping("/register")
    public String registerUser(@Valid @RequestBody UserDTO userDTO) {
        return userService.registerUser(userDTO);
    }

    /**
     * Get user by query param
     * Example: GET /api/users/find?username=srimanta
     */
    @GetMapping("/find")
    public UserDTO getUserByQueryParam(@RequestParam String username) {
        return userService.findByUsername(username);
    }

    /**
     * Get user by path variable
     * Example: GET /api/users/srimanta
     */
    @GetMapping(value = "/{username}", produces = {"application/json", "application/xml"})
    public UserDTO getUserByPath(@PathVariable String username) {
        return userService.findByUsername(username);
    }
}

<!-- Maven -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>

<dependency>
    <groupId>com.h2database</groupId> <!-- Use H2 for testing -->
    <artifactId>h2</artifactId>
    <scope>runtime</scope>
</dependency>

public class User {
    private Long id;
    private String username;
    private String email;
    private String password;

    // Constructors
    public User() {
    }

    public User(String username, String email, String password) {
        this.username = username;
        this.email = email;
        this.password = password;
    }

    // Getters & Setters
    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

@Repository
public class UserRepository {

    @Autowired
    private JdbcTemplate jdbcTemplate;

    @Autowired
    private NamedParameterJdbcTemplate namedParameterJdbcTemplate;

    public int registerUser(User user) {
        String sql = "INSERT INTO users (username, email, password) VALUES (?, ?, ?)";
        return jdbcTemplate.update(sql, user.getUsername(), user.getEmail(), user.getPassword());
    }

    public Optional findUserByUsername(String username) {
        String sql = "SELECT * FROM users WHERE username = :username";
        MapSqlParameterSource params = new MapSqlParameterSource()
                .addValue("username", username);

        List users = namedParameterJdbcTemplate.query(sql, params, new BeanPropertyRowMapper<>(User.class));
        return users.stream().findFirst();
    }
}

@Service
public class UserService {

    private static final Logger logger = LoggerFactory.getLogger(UserService.class);

    @Autowired
    private UserRepository userRepository;

    public String registerUser(UserDTO userDTO) {
        if (findByUsername(userDTO.getUsername()) != null)
            throw new RuntimeException("User already exists");

        User user = new User(userDTO.getUsername(), userDTO.getEmail(), userDTO.getPassword());

        int update = userRepository.registerUser(user);
        String status = update == 1 ? "successful" : "failed";
        logger.info("User '{}' registration {}!", userDTO.getUsername(), status);
        return "User '" + userDTO.getUsername() + "' registration " + status;
    }

    public User findByUsername(String username) {
        logger.info("Finding by username: {}", username);
        Optional user = userRepository.findUserByUsername(username);
        return user.orElse(null);
    }
}

@RestController
@RequestMapping("/api/users")
@Validated // Enables method-level validation (useful for path variables, service params, etc.)
public class UserController {

    @Autowired  // Field injection
    private UserService userService;

    /**
     * Register a new user via POST
     * Example: POST /api/users/register
     */
    @PostMapping("/register")
    public String registerUser(@Valid @RequestBody UserDTO userDTO) {
        return userService.registerUser(userDTO);
    }

    /**
     * Get user by query param
     * Example: GET /api/users/find?username=srimanta
     */
    @GetMapping("/find")
    public User getUserByQueryParam(@RequestParam String username) {
        return userService.findByUsername(username);
    }

    /**
     * Get user by path variable
     * Example: GET /api/users/srimanta
     */
    @GetMapping(value = "/{username}", produces = {"application/json", "application/xml"})
    public User getUserByPath(@PathVariable String username) {
        return userService.findByUsername(username);
    }
}

@Aspect
@Component
public class LoggingAspect {

    private static final Logger logger = LoggerFactory.getLogger(LoggingAspect.class);

    @Before("execution(* com.example.myapp.controller.*.*(..))")
    public void logBefore(JoinPoint joinPoint) {
        logger.info("Entering method: {}", joinPoint.getSignature().toShortString());
    }

    @AfterReturning(pointcut = "execution(* com.example.myapp.controller.*.*(..))", returning = "result")
    public void logAfter(JoinPoint joinPoint, Object result) {
        logger.info("Exiting method: {} with result = {}", joinPoint.getSignature().getName(), result);
    }
}

<!-- Maven -->
<!-- Spring Security -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<!-- JWT -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.12.6</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>

// Gradle
// Spring Boot Starter Security
implementation 'org.springframework.boot:spring-boot-starter-security'

// JWT Dependencies
implementation 'io.jsonwebtoken:jjwt-api:0.12.6'
runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.12.6'
runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.12.6'

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private JwtAuthFilter jwtAuthFilter;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/api/users/register", "/api/auth/login", "/error").permitAll()
                        .anyRequest().authenticated()
                )
                .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        http.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    @Bean
    public AuthenticationManager authenticationManager(UserDetailsService uds, PasswordEncoder encoder) throws Exception {
        return new ProviderManager(new DaoAuthenticationProvider() {{
            setUserDetailsService(uds);
            setPasswordEncoder(encoder);
        }});
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

@Component
public class JwtAuthFilter extends OncePerRequestFilter {

    @Autowired
    private JwtService jwtService;

    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        final String authHeader = request.getHeader("Authorization");

        String username = null;
        String jwt = null;

        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            jwt = authHeader.substring(7);
            username = jwtService.extractUsername(jwt);
        }

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            try {
                UserDetails userDetails = userDetailsService.loadUserByUsername(username);

                if (jwtService.validateToken(jwt, userDetails)) {
                    UsernamePasswordAuthenticationToken token =
                            new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                    token.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(token);
                }
            } catch (Exception e) {
                response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                response.setContentType("application/json");
                response.getWriter().write("{\"error\": \"" + e.getMessage() + "\"}");
                return;
            }
        }

        chain.doFilter(request, response);
    }
}

@Component
public class JwtService {

    @Value("${jwt.secret}")
    // In Spring, @Value or @ConfigurationProperties fields aren't populated yet when the constructor runs (for field injection).
    private String jwtSecret;

    private SecretKey key;

    @PostConstruct      // Runs after dependency injection is complete (after Spring has populated all fields).
    private void postConstruct() {      // Clean separation: constructor → simple wiring, @PostConstruct → post-wiring logic.
        this.key = Keys.hmacShaKeyFor(Base64.getDecoder().decode(jwtSecret));
    }

    public String generateToken(String username) {
        return Jwts.builder()
                .subject(username)
                .issuedAt(Date.from(Instant.now()))
                .expiration(Date.from(Instant.now().plus(Duration.ofHours(1)))) // 1 hour
                .signWith(key)
                .compact();
    }

    public String extractUsername(String token) {
        return Jwts.parser()
                .verifyWith(key)
                .build()
                .parseSignedClaims(token)
                .getPayload()
                .getSubject();
    }

    public boolean validateToken(String token, UserDetails userDetails) {
        return extractUsername(token).equals(userDetails.getUsername());
    }
}

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Optional user = userRepository.findUserByUsername(username);

        if (user.isEmpty())
            throw new UsernameNotFoundException("User not found");

        return new org.springframework.security.core.userdetails.User(
                user.get().getUsername(), user.get().getPassword(), new ArrayList<>()
        );
    }
}

@Service
public class UserService {

    private static final Logger logger = LoggerFactory.getLogger(UserService.class);

    @Autowired
    private UserRepository userRepository;

    public String registerUser(UserDTO userDTO) {
        if (findByUsername(userDTO.getUsername()) != null)
            throw new RuntimeException("User already exists");

        String encodedPassword = new BCryptPasswordEncoder().encode(userDTO.getPassword());
        User user = new User(userDTO.getUsername(), userDTO.getEmail(), encodedPassword);

        int update = userRepository.registerUser(user);
        String status = update == 1 ? "successful" : "failed";
        logger.info("User '{}' registration {}!", userDTO.getUsername(), status);
        return "User '" + userDTO.getUsername() + "' registration " + status;
    }

    public User findByUsername(String username) {
        logger.info("Finding by username: {}", username);
        Optional user = userRepository.findUserByUsername(username);
        return user.orElse(null);
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private UserService userService;

    @Autowired
    private JwtService jwtService;

    @Autowired
    private AuthenticationManager authenticationManager;

    @PostMapping("/register")
    public ResponseEntity<?> register(@RequestBody UserDTO userDTO) {
        userService.registerUser(userDTO);
        return ResponseEntity.ok("User registered");
    }

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody UserDTO userDTO) {
        Authentication auth = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(userDTO.getUsername(), userDTO.getPassword()));
        String token = jwtService.generateToken(userDTO.getUsername());
        return ResponseEntity.ok(Collections.singletonMap("token", token));
    }

    @GetMapping("/secure-check")
    public ResponseEntity secureCheck(Principal principal) {
        return ResponseEntity.ok("Accessed secured endpoint by user: " + principal.getName());
    }
}

# application.properties
# Secret Key (YOUR_GENERATED_BASE64_SECRET_KEY)
jwt.secret=wXRc/fUYMb2IAyXRvB4NYzyLws9oimd226c7nqNqs/fT1dbUewJGN/SEuq/5lQROLVDj62NhyR7AhbTI5gY/FA==

# application.yaml
# Secret Key (YOUR_GENERATED_BASE64_SECRET_KEY)
jwt:
  secret: wXRc/fUYMb2IAyXRvB4NYzyLws9oimd226c7nqNqs/fT1dbUewJGN/SEuq/5lQROLVDj62NhyR7AhbTI5gY/FA==