183 published guides across 3 roadmaps and 18 phases, ordered so each one only assumes what came before. Every tutorial ships complete, runnable code.
From Spring Boot developer to Agentic AI engineer
Refresh the modern Java and Spring Boot foundations every AI integration builds on: records, virtual threads, reactive streams, and containers.
The Java 17-to-21 features that matter most for AI work: records, sealed classes, pattern matching, text blocks and virtual threads — each shown with a concrete AI use case.
Read tutorialFunctional Java refreshed for AI work: streams for document pipelines, Optional for safe metadata access, and CompletableFuture for concurrent model calls — with practical examples.
Read tutorialProject Reactor for AI developers: Mono, Flux, back-pressure and WebFlux — and the one place they are genuinely the right tool, streaming LLM tokens to a browser.
Read tutorialMicroservices patterns that matter for AI systems: API gateway, circuit breakers around model calls, the saga pattern for agent workflows, and where an AI service fits in the topology.
Read tutorialContainerize and deploy a Spring Boot AI application: a production Dockerfile with layered JARs, Kubernetes deployment with secrets for API keys, health probes and resource limits.
Read tutorialMaven and Gradle for Java AI projects: managing Spring AI and LangChain4j versions with BOMs, multi-module layout for projects with separate ingestion and serving, and dependency hygiene.
Read tutorialWire large language models into Spring Boot with Spring AI — chat clients, embeddings, RAG, tool calling, structured output, and production observability.
What Spring AI is, how its abstractions map onto Spring concepts you already know, when to choose it over LangChain4j, and a working ChatClient example in under five minutes.
Read tutorialA complete Spring Boot + OpenAI setup: dependencies, API key management, model options, timeouts, retries and the five errors every developer hits on the first run.
Read tutorialMaster the Spring AI ChatClient: system messages, prompt templates, streaming with SSE, chat memory, advisors and per-call options — with complete Spring Boot code.
Read tutorialPrompt engineering explained for engineers, not marketers: system prompts, few-shot, delimiters, output contracts and grounding — each as testable Spring AI code, not vibes.
Read tutorialHow embeddings and vector stores work in Spring AI, with a complete pgvector Spring Boot setup — schema, indexes, metadata filtering, dimensions and the mistakes that force a re-ingest.
Read tutorialBuild a production RAG pipeline in Spring Boot: document ingestion, chunking, pgvector retrieval, the QuestionAnswerAdvisor, citations, evaluation and the failure modes nobody warns you about.
Read tutorialHow Spring AI function calling works, with complete @Tool examples: registering tools, typed parameters, error handling, the agent loop, and how to stop a tool-using model doing damage.
Read tutorialTurn LLM responses into typed Java objects with Spring AI: BeanOutputConverter, .entity(), generic lists, enums and validation — the reliable alternative to parsing text by hand.
Read tutorialSend images and audio to vision models from Spring Boot with Spring AI: the Media API, image analysis, document extraction from scans, and handling multimodal input safely.
Read tutorialRun local LLMs in Spring Boot with Spring AI and Ollama: setup, model selection, offline development, cost and privacy trade-offs, and when a local model is the right call.
Read tutorialInstrument Spring AI with Micrometer and OpenTelemetry: token and cost metrics per feature, latency tracking, tracing model calls, and dashboards that catch a cost problem before the invoice does.
Read tutorialSecure a Spring Boot AI application against the OWASP LLM Top 10: prompt injection defenses, output validation, rate limiting, PII handling and safe tool authorization — with code.
Read tutorialHow to test non-deterministic AI code in Spring Boot: mocking the ChatModel for unit tests, golden datasets for retrieval, property-based assertions, and LLM-as-judge for quality.
Read tutorialMaster LangChain4j end to end: AI Services, document loaders, splitters, embedding stores, retrievers, memory, and tool-using agents.
A complete LangChain4j introduction for Java developers: core abstractions, the AiServices declarative style, memory, tools and retrieval — plus an honest comparison with Spring AI.
Read tutorialConfigure chat models in LangChain4j: OpenAI, Anthropic Claude, Google Gemini, Mistral and Ollama — with streaming, timeouts, retries and how to swap providers without touching your code.
Read tutorialCompose multi-step LLM workflows in LangChain4j: sequential chains, routing by classification, and building custom chains from AI Services — when to chain and when a single call suffices.
Read tutorialLoad documents into LangChain4j from files, URLs, S3, GitHub and more, and parse PDF, DOCX and HTML with Apache Tika — the ingestion front-end for any RAG pipeline in Java.
Read tutorialChunk documents effectively in LangChain4j: the recursive splitter, chunk size and overlap tuning, splitting code and markdown, and why chunking is the highest-impact decision in RAG.
Read tutorialConfigure embedding models in LangChain4j: hosted models like OpenAI and Cohere, free in-process ONNX models, dimension matching, and choosing an embedding model for RAG.
Read tutorialStore and search vectors in LangChain4j: the in-memory store for tests, PgVector for production, Redis and Elasticsearch, plus metadata filtering and picking the right store.
Read tutorialBuild RAG in LangChain4j with ContentRetriever: attach retrieval to AI Services, transform queries, re-rank results, and assemble an advanced RAG pipeline with the RetrievalAugmentor.
Read tutorialBuild tool-using agents in LangChain4j: the @Tool annotation, how the agent loop works, bounding iterations, safe write tools and the ReAct pattern — with production-ready code.
Read tutorialAdd conversation memory to LangChain4j AI Services: message and token windows, per-user memory with @MemoryId, persistent stores, and why unbounded memory breaks in production.
Read tutorialReturn typed objects from LangChain4j AI Services: POJO and record return types, enums, lists, JSON schema mode and validation — no manual parsing of model responses.
Read tutorialGo from LLM calls to autonomous systems: ReAct, plan-and-execute, reflection, agent memory, multi-agent orchestration, evaluation and guardrails.
A clear, hype-free explanation of agentic AI: how it differs from generative AI, the five components of an agent, when autonomy is worth it, and when a plain workflow is the better engineering choice.
Read tutorialThe core agent architecture patterns explained with Java: ReAct, plan-and-execute, reflection, orchestrator-worker and routing — when to use each, and why simpler is usually better.
Read tutorialHow agents use tools well: designing tool schemas, dynamic tool selection, composing tools into workflows, error recovery, and keeping the tool set small enough to choose from.
Read tutorialHow agents plan and reason: task decomposition, hierarchical planning, chain-of-thought and tree-of-thought — with Java examples and honest guidance on when planning helps.
Read tutorialHow agent memory works beyond a chat window: working, episodic and semantic memory, vector-based recall, memory consolidation, and implementing persistent agent memory in Java.
Read tutorialBuilding multi-agent systems in Java: orchestrator-worker coordination, agent handoffs, communication protocols and conflict resolution — and the honest case for when one agent is better.
Read tutorialA practical comparison of agent frameworks for Java developers: LangChain4j, Spring AI, and how the Python ecosystem (LangGraph, CrewAI, AutoGen) compares — plus when to use no framework at all.
Read tutorialDesign autonomous coding agents in Java: code generation with verification, review agents that bias for precision, refactoring and test-generation agents — with the guardrails they need.
Read tutorialHow to evaluate and test AI agents: trajectory analysis, benchmarking, hallucination detection, outcome verification and human-in-the-loop evaluation — with Java patterns.
Read tutorialAdvanced RAG where the model controls retrieval: self-RAG, corrective RAG, adaptive retrieval and query planning — when to let an agent decide whether and what to retrieve, in Java.
Read tutorialDesign human-in-the-loop AI systems in Java: approval flows for agent actions, escalation patterns, confidence thresholds and feedback loops — how to deploy autonomy without accepting unbounded risk.
Read tutorialTake agents to production: per-run budgets and step caps, guardrails, durable execution, scaling on the JVM, cost control and the operational patterns that keep agents from causing incidents.
Read tutorialBuild responsible AI agents: managing bias, ensuring transparency and accountability, designing for contestability, and the engineering practices that make agents safe and fair.
Read tutorialThe model-side knowledge that separates an integrator from an AI engineer: transformers, fine-tuning, vector search internals, evaluation and LLMOps.
Understand the foundation models you build on: GPT, Claude, Gemini, Llama and Mistral families, how they differ, and a practical framework for choosing a model for your Java application.
Read tutorialThe transformer architecture explained for engineers, not researchers: self-attention, multi-head attention, positional encoding and why it explains context limits, token cost and hallucination.
Read tutorialUnderstand fine-tuning for engineers: LoRA and QLoRA, instruction tuning, RLHF and DPO, and the crucial decision of when to fine-tune versus when retrieval or prompting is the better tool.
Read tutorialHow vector databases work under the hood: the HNSW index, approximate nearest-neighbour search, cosine vs Euclidean distance, product quantization and metadata filtering — for Java developers.
Read tutorialHow embedding models power semantic search: bi-encoders vs cross-encoders, re-ranking, hybrid search combining keywords and vectors, and choosing embeddings for retrieval quality.
Read tutorialAdvanced prompt engineering techniques: prompt chaining, meta-prompting, self-consistency, structured reasoning and prompt optimization — beyond the basics, for reliable production prompts.
Read tutorialUnderstand tokens and context windows: how BPE tokenization works, why code costs more tokens, managing the context budget, and the token math behind LLM cost — for Java developers.
Read tutorialHow to evaluate LLMs and LLM applications: what public benchmarks like MMLU and HumanEval measure, their limits, and building a custom evaluation suite that reflects your real task.
Read tutorialMake models smaller and faster: quantization (GGUF, GPTQ, AWQ), knowledge distillation, the accuracy-vs-efficiency trade-off, and when self-hosting a compressed model makes sense.
Read tutorialBuild guardrails around LLMs: input filtering, output validation against schemas and rules, content moderation, jailbreak defense and layered safety — deterministic controls in Java.
Read tutorialThe operational practice of running LLM features: prompt versioning, evaluation in CI/CD, model registries, A/B testing and canary rollouts of prompt and model changes — for Java teams.
Read tutorialRun generative AI on the major clouds from Java: Amazon Bedrock, Azure OpenAI and Google Vertex AI compared, with Spring AI and LangChain4j integration and how to choose.
Read tutorialArchitectural patterns for shipping AI inside real systems: streaming APIs, event-driven pipelines, semantic caching, multi-tenancy and low-latency serving.
Design robust AI REST APIs in Spring Boot: streaming with Server-Sent Events, async processing for long tasks, timeouts, back-pressure and the API patterns that make AI features reliable.
Read tutorialBuild event-driven AI systems with Kafka and Spring Boot: async AI processing pipelines, decoupling model calls from request threads, dead-letter handling and back-pressure for LLM workloads.
Read tutorialIntegrate AI into CI/CD pipelines: automated code review, test generation, documentation and PR triage — with the precision discipline and guardrails that keep these bots useful, not noisy.
Read tutorialBuild AI-powered search in Java: hybrid keyword-plus-vector search, faceted filtering, query understanding, personalization and re-ranking — beyond both keyword search and naive RAG.
Read tutorialDesign production chatbots in Java: intent classification, dialog state management, slot filling, multi-turn context, tool integration and handoff to humans — beyond a single ChatClient call.
Read tutorialApply LLMs to data engineering in Java: text-to-SQL with safety guards, AI-assisted data cleaning, schema mapping and anomaly detection — where AI helps and where it must be constrained.
Read tutorialObserve LLM applications in production: distributed tracing of model and retrieval calls, LangFuse and OpenTelemetry GenAI conventions, span attributes, and cost dashboards for Java teams.
Read tutorialBuild multi-tenant AI systems in Java: strict tenant isolation in retrieval, per-tenant quotas and rate limits, cost allocation, and data residency — keeping tenants apart safely at scale.
Read tutorialCut LLM cost and latency with caching: exact-match caching, semantic caching by embedding similarity, provider prompt caching, and invalidation — with Redis and Java examples.
Read tutorialServe LLMs with low latency: time to first token, streaming, continuous batching, vLLM and TGI, speculative decoding, and the latency levers available whether you self-host or use an API.
Read tutorialWhere the field is heading: multimodal agents, GraphRAG, small language models, enterprise agent platforms, regulation, and your career roadmap.
Build multimodal agents that reason over images, audio and screens: vision-language agents, document-understanding agents, computer-use patterns and the guardrails they need.
Read tutorialHow AI code generation works and how to use it well: repository context, code LLMs, evaluating generated code, and the judgement to accept, verify or reject what the model produces.
Read tutorialApply AI to DevOps and SRE in Java: incident investigation agents, LLM log analysis, alert correlation and runbook automation — with the read-only-first, human-approved discipline ops demands.
Read tutorialGo beyond vector RAG with GraphRAG: knowledge graphs in Neo4j, entity and relationship extraction, graph retrieval for multi-hop questions, and when a graph beats a vector store.
Read tutorialWhen smaller models win: SLMs like Phi and Gemma, on-device and edge AI, model routing between small and large models, and the cost and latency case for not always reaching for the biggest model.
Read tutorialDeploy AI agents in the enterprise: integrating with SAP, Salesforce and ServiceNow, SSO and identity, audit trails, approval workflows and the governance enterprise agents require.
Read tutorialPrivacy-preserving AI techniques for engineers: federated learning, differential privacy, PII redaction, secure processing and the practical patterns for handling sensitive data with LLMs.
Read tutorialWhat developers need to know about AI regulation: the EU AI Act risk tiers, GDPR for AI, ISO 42001 and the NIST AI RMF — and the engineering practices that keep AI systems compliant.
Read tutorialChoose an AI model strategy: open-weight vs proprietary hosted models, total cost of ownership, vendor lock-in risk, hybrid approaches and migration paths — a decision framework for Java teams.
Read tutorialThe Java developer to AI engineer career path: the skills that matter, how to build a portfolio, where the field is heading, and how to keep learning in a fast-moving space.
Read tutorialFrom Spring Boot novice to enterprise architect
Stop treating Spring Boot as magic. Auto-configuration, the IoC container lifecycle, AOP proxies, caching, scheduling, JPA and Redis — how each one actually works, and what breaks when it does not.
How Spring Boot auto-configuration actually works: the import selector, the @Conditional family, ordering rules, the --debug report, and how to write your own starter.
Read tutorialThe Spring container from the inside: the full bean lifecycle in order, what BeanPostProcessor actually intercepts, every bean scope, and how circular dependencies are resolved.
Read tutorialType-safe configuration with @ConfigurationProperties, the full property precedence order, relaxed binding rules, profile groups, and keeping secrets out of your YAML.
Read tutorialSpring AOP from pointcut syntax to proxy mechanics: the five advice types, writing annotation-driven aspects, aspect ordering, and why self-invocation silently does nothing.
Read tutorialEvery Actuator endpoint worth exposing, writing custom health indicators for Kubernetes probes, adding Micrometer metrics that answer real questions, and securing it all.
Read tutorialA test strategy that stays fast: when to use @SpringBootTest versus a slice, real databases with Testcontainers and @ServiceConnection, stubbing HTTP with WireMock, and context caching.
Read tutorialA consistent error contract for a Spring Boot API: an exception hierarchy worth having, @ControllerAdvice done properly, RFC 7807 ProblemDetail, and validation errors clients can act on.
Read tutorialSpring cache abstraction in practice: @Cacheable key design, choosing between Caffeine and Redis, per-cache TTLs, cache stampedes, and a two-level cache that survives a Redis outage.
Read tutorialScheduled tasks and async methods done properly: fixedRate versus fixedDelay, sizing executors, exception handling that does not silently swallow, and distributed locking with ShedLock.
Read tutorialEntity mapping that scales: relationship pitfalls, diagnosing and fixing the N+1 problem, derived queries versus Specifications, pagination that stays fast, and JPA auditing.
Read tutorialRedis beyond caching: choosing the right data structure, distributed locks that are actually safe, Redis Streams as a queue, and configuring Lettuce for Sentinel and Cluster.
Read tutorialJakarta Bean Validation in Spring Boot: the full constraint set, custom validators, validation groups, cross-field rules, method validation and where each layer belongs.
Read tutorialLogging that helps at 3am: choosing levels that mean something, MDC correlation IDs across threads, structured JSON output, async appenders, and what must never be logged.
Read tutorialHandling uploads and downloads safely: multipart limits, detecting real content types with Tika, streaming large files, S3 and MinIO integration, and presigned URLs.
Read tutorialDesign APIs other teams enjoy consuming: correct resource modelling and status codes, versioning that survives contact with real clients, pagination, rate limiting, RFC 7807 errors, GraphQL and WebSockets.
The decisions that make an API pleasant to consume: resource naming, method semantics and idempotency, choosing the right status code, HATEOAS, and the Richardson maturity model.
Read tutorialEverything a Spring controller can bind, how ResponseEntity builds responses properly, content negotiation, custom argument resolvers, and keeping controllers thin.
Read tutorialGenerating documentation people actually use: springdoc-openapi setup, annotations worth adding, grouping large APIs, documenting errors and auth, and the API-first workflow.
Read tutorialComparing URI, header, query and media-type versioning honestly, deciding what counts as breaking, running two versions at once, and retiring one without breaking clients.
Read tutorialPagination that stays fast at depth: why OFFSET degrades, keyset and cursor pagination, dynamic filtering with Specifications, safe sorting, and the RFC 8288 Link header.
Read tutorialThe five rate-limiting algorithms compared, distributed limiting with Redis and Bucket4j, per-tier quotas, and the response headers clients need to behave well.
Read tutorialDesigning an error contract on RFC 7807: the standard fields, extension properties worth adding, an error catalogue, internationalised messages, and errors across service boundaries.
Read tutorialCalling other services without taking yourself down: WebClient configuration, the four timeouts that matter, connection pool sizing, retry with backoff, and testing against a real socket.
Read tutorialBuilding a GraphQL API with Spring for GraphQL: schema-first mapping, solving N+1 with batch mapping, field-level authorisation, and the query limits every public endpoint needs.
Read tutorialReal-time push in Spring: STOMP over WebSocket, broadcasting and user-targeted messages, authenticating the handshake, scaling with an external broker, and when SSE is the better fit.
Read tutorialThe whole distributed-systems toolkit: decomposing by bounded context, discovery, gateways, resilience, sagas and the outbox pattern, tracing, containers, Kubernetes and service mesh.
Finding service boundaries that hold: decomposing by business capability and subdomain, context mapping patterns, the anti-corruption layer, and the strangler fig migration.
Read tutorialClient-side versus server-side discovery, running Eureka properly including self-preservation, Consul as an alternative, and why Kubernetes usually makes a separate registry unnecessary.
Read tutorialBuilding an edge gateway: route predicates, the filter catalogue, custom global filters for auth and correlation, Redis rate limiting, and circuit breakers at the edge.
Read tutorialChoosing how services talk: synchronous REST and gRPC versus asynchronous messaging, the coupling each creates, correlation propagation, and graceful degradation.
Read tutorialResilience4j in production: how the circuit breaker state machine works, tuning the sliding window, combining retry and bulkhead correctly, and the decorator order that matters.
Read tutorialDistributed tracing that actually helps: spans and trace context, W3C propagation across HTTP and messaging, sampling strategies, and correlating traces with logs and metrics.
Read tutorialWhy two-phase commit fails in microservices, choreography versus orchestration sagas, compensating transactions, the transactional outbox, and idempotent consumers.
Read tutorialDesigning events that last: domain versus integration events, Avro and schema registry compatibility, event sourcing basics, ordering guarantees and schema evolution.
Read tutorialA testing strategy for distributed systems: where the pyramid changes shape, consumer-driven contract testing, component tests with Testcontainers, and why end-to-end tests fail you.
Read tutorialBuilding small, fast, secure Spring Boot images: multi-stage builds, BuildKit cache mounts, layered jars, JVM container awareness, distroless bases and vulnerability scanning.
Read tutorialRunning Spring Boot on Kubernetes properly: liveness versus readiness probes, JVM memory inside cgroups, resource requests and limits, autoscaling, and zero-downtime rollouts.
Read tutorialWhat a service mesh moves out of your application: automatic mTLS, VirtualService routing, outlier detection, authorization policies, fault injection and progressive delivery.
Read tutorialAssembling logs, metrics and traces into something usable: PromQL that answers real questions, the Grafana stack, golden signals, and alerts that mean something.
Read tutorialSecuring a distributed system: authentication at the edge, mTLS and workload identity between services, token propagation without over-trust, API keys and secret management.
Read tutorialCentralised configuration done safely: Config Server with a Git backend, client bootstrap and fail-fast, @RefreshScope, encrypted values, and when Kubernetes ConfigMaps are enough.
Read tutorialBoth brokers, properly. AMQP exchanges and routing, Kafka partitions and consumer groups, Spring AMQP and Spring Kafka, Kafka Streams, Connect, production operations — and a framework for choosing between them.
The vocabulary and patterns every broker shares: point-to-point versus publish-subscribe, competing consumers, acknowledgement modes, dead-letter queues and delivery guarantees.
Read tutorialAMQP 0-9-1 from the ground up: the four exchange types and when each fits, queue properties, bindings and routing keys, prefetch and fairness, and publisher confirms.
Read tutorialSpring AMQP in production: RabbitTemplate and message converters, @RabbitListener containers, manual acknowledgement, retry with backoff, and a dead-letter topology that works.
Read tutorialBeyond basic queues: quorum queues and Raft, clustering and partition handling, federation and shovel for multi-datacentre, priority and lazy queues, and delayed delivery.
Read tutorialHow Kafka actually works: the partitioned log, leaders and in-sync replicas, producer acks and idempotence, consumer groups and rebalancing, and offset management.
Read tutorialSpring for Apache Kafka in production: KafkaTemplate, @KafkaListener containers, JSON serialisation without trusting the wire, DefaultErrorHandler with backoff, and dead-letter topics.
Read tutorialStream processing without a cluster: KStream and KTable semantics, stateless and stateful operations, windowing, joins, exactly-once v2 and testing with TopologyTestDriver.
Read tutorialMoving data in and out of Kafka without writing code: source and sink connectors, Debezium change data capture, single message transforms, and running Connect in distributed mode.
Read tutorialRunning Kafka for real: partition and cluster sizing, retention versus compaction, the metrics that predict incidents, the CLI tools worth knowing, and geo-replication.
Read tutorialA practical comparison across throughput, latency, ordering, replay, routing and operational cost — with the use cases each one clearly wins, and when to run both.
Read tutorialOne programming model over Kafka and RabbitMQ: functional bindings, destination configuration, per-binder tuning, dead-letter handling and the in-memory test binder.
Read tutorialEverything between "it works on my machine" and "it survives Black Friday": pipelines, Docker, Kubernetes rollouts, Terraform, OpenTelemetry, Flyway, JVM tuning, load testing and disaster recovery.
A pipeline that stays fast as the codebase grows: stage design, GitHub Actions with dependency and Docker caching, test parallelisation, and quality gates that catch real problems.
Read tutorialContainer builds that are fast and trustworthy: BuildKit cache and secret mounts, tagging strategy, registry choice, vulnerability scanning, SBOM generation and image signing.
Read tutorialShipping without downtime: rolling update mechanics, blue-green switching, canary with automated analysis, and GitOps reconciliation with Argo CD.
Read tutorialProvisioning the infrastructure a Java service needs: Terraform state and locking, reusable modules, managed databases and brokers, and where Pulumi fits.
Read tutorialAssembling a production observability stack: the OTel agent and collector pipelines, Mimir, Loki and Tempo, alerting strategy that avoids fatigue, and runbooks that get used.
Read tutorialConfiguration that survives production: the 12-factor principles applied to Java, property precedence, fail-fast validation, feature flags, and graceful shutdown done properly.
Read tutorialSchema changes you can deploy safely: Flyway naming and ordering, repeatable migrations, baselining an existing database, and expand-and-contract for zero downtime.
Read tutorialDiagnosing and fixing JVM performance: the memory model, choosing and tuning a collector, reading GC logs, profiling with JFR and async-profiler, and container-aware settings.
Read tutorialFinding your limits before users do: the five load test types, writing k6 and Gatling scenarios, the metrics that matter, and turning results into a capacity plan.
Read tutorialPlanning for failure: defining RPO and RTO honestly, replication trade-offs, multi-region topologies and their costs, DNS failover, and testing recovery before you need it.
Read tutorialThe senior-engineer layer: GoF patterns as Spring actually uses them, CQRS and event sourcing, DDD in practice, transaction semantics, API security, gRPC, sharding and enterprise integration patterns.
The GoF patterns as Spring actually implements them, the ones worth writing yourself, and modern Java alternatives using records, sealed types and pattern matching.
Read tutorialSeparating reads from writes: CQRS without event sourcing, event stores and aggregate replay, building projections, snapshots, and an honest account of when not to use either.
Read tutorialDDD applied rather than described: choosing aggregate boundaries, value objects that enforce invariants, repositories, hexagonal architecture, and running an event storming session.
Read tutorialTransactions beyond the annotation: every propagation mode and when it applies, isolation levels and the anomalies they prevent, transaction-bound events, and why XA lost to sagas.
Read tutorialThe API-specific vulnerability classes and their Spring fixes: broken object-level authorization, mass assignment, unrestricted consumption, SSRF, and API inventory management.
Read tutorialgRPC for internal service calls: Protocol Buffers and schema evolution, the four RPC types, deadlines and interceptors, Spring Boot integration, and an honest comparison with REST.
Read tutorialScaling past one database: read replicas and routing, choosing a shard key you will not regret, hash versus range sharding, cross-shard queries, and migrating without downtime.
Read tutorialThe vocabulary of system integration: routers, splitters, aggregators, content enrichers and the claim check, implemented with Apache Camel and Spring Integration.
Read tutorialFrom basic authentication to zero-trust architecture
The filter chain, and every way to prove who someone is: passwords, JWT, OAuth 2.0, OIDC, SAML, LDAP — plus the authorisation models and cryptography you build on top of them.
How Spring Security actually works: the filter chain and its ordering, SecurityContextHolder, the AuthenticationManager delegation model, and where to plug in custom logic.
Read tutorialStoring passwords properly: choosing between BCrypt, Argon2 and scrypt, DelegatingPasswordEncoder for zero-downtime migration, strength rules, and breached-password checks.
Read tutorialThe two classic authentication mechanisms: when Basic is appropriate, configuring form login properly, custom success and failure handlers, logout, and account lockout that is not a DoS.
Read tutorialWhere user credentials live: in-memory users for tests, JdbcUserDetailsManager and its schema, writing a custom UserDetailsService, and seeding an initial administrator safely.
Read tutorialJWTs done safely: structure and claims, why RS256 beats HS256, key rotation with JWKS, the alg=none and key-confusion attacks, and how to revoke a stateless token.
Read tutorialOAuth 2.0 without the confusion: the four actors, the grants that still matter, why PKCE is mandatory, refresh token rotation, and what OAuth 2.1 removed.
Read tutorialRunning your own OAuth 2.1 and OIDC provider: registering clients, persisting authorizations, JWK sources and key rotation, custom claims, and the consent page.
Read tutorialValidating tokens correctly: NimbusJwtDecoder configuration, issuer and audience validators, mapping claims to authorities, opaque token introspection and multi-tenant decoding.
Read tutorialThe identity layer on OAuth 2.0: what an ID token is and how to validate it, standard scopes and claims, discovery, and single logout across relying parties.
Read tutorialAdding sign in with Google, GitHub and Microsoft: client registration, mapping provider profiles to your user model, safe account linking, and the onboarding flow afterwards.
Read tutorialEnterprise SSO with SAML: the SP-initiated flow step by step, RelyingPartyRegistration, the assertion checks that matter, metadata exchange and single logout.
Read tutorialAuthenticating against a corporate directory: LDAP structure, bind versus password comparison, ActiveDirectoryLdapAuthenticationProvider, group-to-role mapping and LDAPS.
Read tutorialAuthorisation with roles: HTTP versus method security, role hierarchies, @PreAuthorize and @PostAuthorize, custom PermissionEvaluator, and where RBAC stops being enough.
Read tutorialWhen roles are not enough: the PDP/PEP model, Open Policy Agent and Rego, integrating OPA with Spring, and deciding between ABAC and a richer RBAC.
Read tutorialApplied cryptography without inventing anything: choosing AES-GCM, envelope encryption, encrypting database columns with an AttributeConverter, and Vault Transit for key management.
Read tutorialEach major web attack class, how it actually works against a Spring application, and the specific configuration or code that stops it — CSRF, CORS, headers, TLS, injection, XSS, uploads, SSRF and deserialisation.
How CSRF works, how Spring CsrfFilter stops it, SameSite cookies as a second layer, the double-submit pattern for SPAs, and exactly when disabling CSRF is correct.
Read tutorialUnderstanding the same-origin policy, what preflight actually checks, configuring CORS in Spring correctly, and why allowedOrigins star with credentials is refused.
Read tutorialEvery security header worth setting: what each one prevents, the values to use, Spring configuration, and how to roll out a Content Security Policy without breaking the site.
Read tutorialConfiguring TLS properly: the handshake, keystores and PKCS12, HTTP to HTTPS redirect, mutual TLS for service-to-service, cipher policy, and where to terminate.
Read tutorialHow SQL injection actually works, why parameterised queries stop it, the JPA and JdbcTemplate patterns that are safe, the ones that are not, and how to test for it.
Read tutorialStopping cross-site scripting: the three XSS types, why encoding must be context-aware, Thymeleaf escaping, OWASP Java Encoder, nonce-based CSP and sanitising rich text.
Read tutorialEvery attack a file upload enables and its defence: extension allowlists, real content-type detection with Tika, path traversal, polyglot files, SVG, and safe serving.
Read tutorialStopping server-side request forgery: why cloud metadata endpoints are the prize, validating URLs correctly, defeating DNS rebinding, and egress controls as a second layer.
Read tutorialWhy readObject on untrusted data is remote code execution, how gadget chains work, ObjectInputFilter as a mitigation, and the Jackson polymorphic typing configuration to avoid.
Read tutorialSecuring AI features in a Spring application: why prompt injection cannot be fully solved, treating model output as untrusted, capability scoping for agents, and cost-based denial of service.
Read tutorialBeyond the login form: TOTP and WebAuthn second factors, session fixation and concurrency control, remember-me token rotation, single sign-on, and Kerberos for domain-joined intranets.
Implementing a second factor: TOTP enrolment and verification, recovery codes, trusted-device handling, and why WebAuthn is the endpoint worth aiming at.
Read tutorialSessions done safely: creation policies, session fixation defence, concurrent session limits, cookie flags that matter, and distributed sessions with Spring Session and Redis.
Read tutorialKeeping users signed in safely: hash-based versus persistent tokens, series rotation and how it detects theft, cookie configuration, and invalidating on password change.
Read tutorialDesigning single sign-on across several applications: the trust model, choosing SAML or OIDC per tenant, silent authentication, single logout, and running Keycloak as the broker.
Read tutorialSeamless Windows domain authentication: how Kerberos tickets work, SPNEGO negotiation over HTTP, keytab and SPN setup, Spring configuration, and diagnosing the usual failures.
Read tutorialProving the controls work and keeping them working: spring-security-test, penetration testing methodology, pipeline security gates, threat modelling and secrets management.
Writing security tests that catch real gaps: @WithMockUser and @WithUserDetails, MockMvc request post-processors, testing method security, mock JWTs, and the negative tests that matter.
Read tutorialA structured approach to testing your own application: reconnaissance, authentication and authorisation testing, injection, business logic flaws, and the tools that help.
Read tutorialSecurity gates that catch real problems without blocking delivery: pre-commit secret scanning, SAST with FindSecBugs, dependency and container scanning, DAST, and tuning out the noise.
Read tutorialFinding design flaws before they ship: drawing data flow diagrams, applying STRIDE per element, prioritising with DREAD, and running a session that produces actionable work.
Read tutorialGetting secrets out of configuration: taking an inventory, Vault KV and dynamic database credentials, Kubernetes auth, the External Secrets Operator, and rotation that works.
Read tutorialWhat auditors and regulators ask for, and the architecture that answers them: GDPR data-subject rights, tamper-evident audit logs, zero-trust design and cryptographic key management.
Implementing the parts of GDPR that reach the code: data subject access and export, consent records, erasure through anonymisation, retention jobs, and breach notification.
Read tutorialBuilding an audit trail that stands up to scrutiny: what to record, a structured event format, hash-chained tamper evidence, Hibernate Envers, and shipping to a SIEM.
Read tutorialBuilding zero-trust in practice: the NIST model, workload identity with SPIFFE, mTLS everywhere, per-request authorization, micro-segmentation, and just-in-time access.
Read tutorialManaging keys across their lifecycle: generation, storage in HSMs and KMS, envelope encryption, rotation without re-encrypting everything, and the key hierarchy that makes it work.
Read tutorialThe capstone architecture: an auth server, security gateway, OPA policy engine, secrets service, audit service and self-service portal, and how they fit together.
Read tutorial