Spring Boot Roadmap : Learn Spring Step by Step

How to use this RoadMap

• Follow the phases in order. AOP, transactions and security all rest on how the container creates and wraps beans.

• For each section, explain the key idea aloud in two minutes, then prove it with a tiny project.

• Use the checkpoints: answer them without notes.

Suggested phases

1. Foundation (Sections 1, 2): understand how Spring builds and wires an app.

2. Web and data (Sections 4, 5, 7): build a REST API backed by a database.

3. Correctness and safety (Sections 3, 6, 8): understand proxies, transactions and security.

4. Quality and operations (Sections 9, 11): test, cache, schedule and observe.

5. Mastery (Sections 10, 12): extend the container and reason about internals.

1. Core Foundations

Key idea: Your code does not create or look up its collaborators. The container creates objects (beans), wires them together and manages their lifecycle. That is Inversion of Control.

Concepts

• IoC and DI: IoC is the principle, DI is the mechanism.

• BeanFactory vs ApplicationContext: the basic container vs the full one (events, i18n, resources, environment). You always use ApplicationContext.

• Beans and the bean lifecycle: instantiate, inject dependencies, aware callbacks, BeanPostProcessor (before), @PostConstruct, BeanPostProcessor (after), ready, @PreDestroy.

• Scopes: singleton (default), prototype, request, session, application.

• Component scanning and stereotypes: @Component, @Service, @Repository, @Controller, @RestController.

• Java config: @Configuration + @Bean; why @Configuration classes are CGLIB-proxied.

• Injection styles: constructor, setter, field. Prefer constructor injection.

• Disambiguation: @Qualifier, @Primary.

• Configuration: @Value, @ConfigurationProperties, Environment and PropertySources, Profiles, Relaxed Binding.

Common traps

• A singleton holding a prototype or request-scoped bean keeps one instance forever. Use a scoped proxy, ObjectProvider or @Lookup.

• Singletons are shared across threads, so keep them stateless or thread-safe.

• Field injection hides dependencies and hurts testability.

• @Value does not support relaxed binding; @ConfigurationProperties does.

Checkpoint

• What happens between SpringApplication.run() and a bean being ready?

• Why is constructor injection preferred?

• Spring singleton scope vs the Singleton design pattern?

2. Auto-Configuration and Spring Boot Specifics

Key idea: Boot is Spring plus opinionated defaults. Auto-configuration registers beans conditionally and backs off when you define your own.

Concepts

• @SpringBootApplication = @Configuration + @EnableAutoConfiguration + @ComponentScan.

• Auto-configuration: candidates listed in META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports, filtered by conditions.

• Starters: curated dependency bundles (spring-boot-starter-web, -data-jpa, -security, -test).

• Conditionals: @ConditionalOnClass, @ConditionalOnMissingBean, @ConditionalOnProperty, @ConditionalOnBean.

• Externalized config: application.properties / .yml, profile files, environment variables, command-line args.

• Precedence (simplified, high to low): command-line args, system properties, OS env vars, profile files, default file, code defaults.

• Actuator basics: /health, /info, /metrics.

Common traps

• Component scan covers only the main class's package and below.

• Defining your own bean usually disables the auto-configured one.

• Run with --debug to see the conditions report.

Checkpoint

• How does Boot decide to configure a DataSource?

• How do you override a property per environment without changing code?

3. Aspect-Oriented Programming (AOP)

Key idea: Spring adds cross-cutting behavior by wrapping beans in proxies. Understand the proxy and most "magic" annotations stop being magic.

Concepts

• Vocabulary: aspect, join point, pointcut, advice, weaving, target, proxy.

• Advice: @Before, @After, @AfterReturning, @AfterThrowing, @Around.

• Proxies: JDK dynamic proxy (interfaces) vs CGLIB (classes, Boot default). Spring AOP is runtime proxy-based, unlike AspectJ weaving.

• Pointcuts: execution(...), within(...), @annotation(...).

• Custom aspects: logging, timing, auditing with @Aspect and a custom annotation.

• Real uses: @Transactional, @Cacheable, @Async, @PreAuthorize.

Common traps

• Self-invocation: this.method() bypasses the proxy, so no advice runs.

• Only public methods on Spring-managed beans are advised by default.

• final classes and methods cannot be CGLIB-proxied.

Checkpoint

• Why does @Transactional fail on a same-class call?

• JDK proxy vs CGLIB: when is each used?

4. Spring MVC (Web Layer)

Key idea: Every request flows through one front controller, the DispatcherServlet, which delegates to handlers and converters.

Concepts

• Request flow: Filter, DispatcherServlet, HandlerMapping, HandlerAdapter, Interceptor, Controller, message converter, response.

• Controllers: @Controller vs @RestController.

• Mappings: @RequestMapping, @GetMapping, @PostMapping, @PutMapping, @PatchMapping, @DeleteMapping.

• Binding: @RequestBody, @ResponseBody, @PathVariable, @RequestParam, @RequestHeader.

• Converters and content negotiation: JSON via Jackson, driven by Accept and Content-Type.

• Responses: ResponseEntity, status codes, ProblemDetail.

• Exception handling: @ExceptionHandler, @RestControllerAdvice, ResponseStatusException.

• Filters vs interceptors: filters are servlet-level; interceptors are MVC-level with handler access.

Common traps

• Returning entities directly leaks internals and causes serialization issues. Use DTOs.

• Keep one consistent error response format.

Checkpoint

• Trace POST /users from socket to JSON response.

• When would you pick a filter over an interceptor?

5. Spring Data JPA

Key idea: Repositories are interfaces; Spring generates the implementation. Hibernate tracks entity state in a persistence context.

Concepts

• JPA vs Hibernate: specification vs implementation.

• Mapping: @Entity, @Table, @Column, @Id, @GeneratedValue, @Embeddable, @Enumerated.

• Relationships: @OneToOne, @OneToMany, @ManyToOne, @ManyToMany, owning side, mappedBy.

• Cascade and fetch: CascadeType, orphanRemoval, LAZY (preferred) vs EAGER.

• Repositories: CrudRepository, PagingAndSortingRepository, JpaRepository.

• Queries: derived methods, @Query (JPQL and native), @Modifying, projections.

• Pagination: Pageable, Page vs Slice.

• Auditing: @CreatedDate, @LastModifiedDate, @EnableJpaAuditing.

• EntityManager: entity states, dirty checking, flush.

• Migrations: Flyway or Liquibase, not ddl-auto=update in production.

Common traps

• N+1 selects: fix with JOIN FETCH, entity graphs or batch fetching.

• LazyInitializationException outside a transaction.

• Bidirectional relationships need both sides kept in sync; write equals/hashCode carefully.

• Know what spring.jpa.open-in-view does before relying on or disabling it.

Checkpoint

• What is the persistence context, and what does dirty checking do?

• How do you diagnose and fix N+1?

6. Transaction Management

Key idea: @Transactional is an AOP proxy that opens a transaction before the method and commits or rolls back after it.

Concepts

• Declarative vs programmatic: @Transactional vs TransactionTemplate.

• Propagation: REQUIRED (default), REQUIRES_NEW, NESTED, SUPPORTS, NOT_SUPPORTED, MANDATORY, NEVER.

• Isolation: READ_UNCOMMITTED, READ_COMMITTED, REPEATABLE_READ, SERIALIZABLE, and the anomalies each prevents.

• Rollback rules: unchecked exceptions and errors by default; use rollbackFor for checked ones.

• Read-only transactions and the transaction proxy (same rules as AOP).

Common traps

• Catching an exception inside the method swallows the rollback.

• @Transactional on private or internally called methods does nothing.

• Long transactions around remote calls hold DB connections.

• REQUIRES_NEW suspends the outer transaction and uses another connection.

Checkpoint

• A REQUIRED method calls a REQUIRES_NEW method that throws. What happens?

• Why don't checked exceptions roll back by default?

7. Validation

Key idea: Declare constraints on the model and enforce them at the boundary.

Concepts

• Jakarta Bean Validation: @NotNull, @NotBlank, @NotEmpty, @Size, @Min, @Max, @Email, @Pattern, @Positive, @Past.

• @Valid vs @Validated: cascading validation vs groups and method-level validation.

• Groups: different rules for create and update.

• Custom validators: a constraint annotation plus a ConstraintValidator, including cross-field rules.

• Error handling: MethodArgumentNotValidException, ConstraintViolationException.

Common traps

• @NotNull, @NotEmpty and @NotBlank differ by type and strictness.

• Validation does not replace database constraints or business rules.

Checkpoint

• How would you validate that endDate is after startDate?

8. Security (Spring Security Fundamentals)

Key idea: Security is a chain of servlet filters. Authentication establishes who you are; authorization decides what you may do.

Concepts

• Architecture: SecurityFilterChain, AuthenticationManager, AuthenticationProvider, SecurityContextHolder.

• Users: UserDetailsService, UserDetails, GrantedAuthority.

• Password encoding: BCrypt or Argon2, never plain text.

• Request rules: authorizeHttpRequests.

• Method security: @EnableMethodSecurity, @PreAuthorize, @PostAuthorize, @Secured.

• CSRF: protects cookie-based sessions; often disabled for stateless token APIs.

• CORS: a browser policy configured on the server; different from CSRF.

• Next step: JWT and OAuth2 resource server.

Common traps

• Modern Spring Security uses a SecurityFilterChain bean; WebSecurityConfigurerAdapter is removed.

• Filter order matters; CORS must be handled before authentication.

Checkpoint

• What happens to a request to a protected endpoint with no credentials?

• CSRF vs CORS: what does each prevent?

9. Testing Concepts

Key idea: Test the smallest slice of the context that proves the behavior.

Concepts

• @SpringBootTest: full context, integration level (use sparingly).

• @WebMvcTest: controller layer with MockMvc.

• @DataJpaTest: JPA layer with a test database, rolled back per test.

• Mocking: @MockBean / @SpyBean (newer: @MockitoBean / @MockitoSpyBean).

• Other slices: @JsonTest, @RestClientTest. Add Testcontainers for realistic databases.

Common traps

• Overusing @SpringBootTest slows the suite.

• H2 can behave differently from your production database.

• Many different mock combinations create many contexts and defeat caching.

Checkpoint

• Which annotation would you use to test controller validation, and why?

10. Advanced Container Features

Key idea: The container is extensible; Spring AOP and Boot are built from these hooks.

Concepts

• BeanFactoryPostProcessor: modifies bean definitions before creation.

• BeanPostProcessor: modifies or wraps beans after creation (where proxies are made).

• Events: ApplicationEventPublisher, @EventListener, @TransactionalEventListener.

• @Lazy: defers initialization and can break cycles.

• Circular dependencies: redesign, setter injection, @Lazy, or extract a third bean. Boot forbids them by default.

• @Lookup and ObjectProvider for prototype-in-singleton.

• FactoryBean: a bean that produces another object.

• Lifecycle / SmartLifecycle: ordered start and stop, graceful shutdown.

Checkpoint

• Where in the lifecycle is an AOP proxy created?

• BeanPostProcessor vs BeanFactoryPostProcessor?

11. Cross-Cutting and Supporting Concepts

Key idea: Most are one annotation plus one enable switch, all proxy-based, so the proxy caveats from Section 3 apply.

Concepts

• Logging: SLF4J with Logback, levels, MDC correlation IDs, structured logs.

• i18n: MessageSource, LocaleResolver, message bundles.

• Caching: @EnableCaching, @Cacheable, @CacheEvict, @CachePut, keys, TTL via Caffeine or Redis.

• Scheduling: @EnableScheduling, @Scheduled (fixed rate, fixed delay, cron).

• Async: @EnableAsync, @Async, CompletableFuture, custom executors.

• Task execution: TaskExecutor, ThreadPoolTaskExecutor, TaskScheduler.

Common traps

• Self-invocation breaks @Cacheable and @Async too.

• Configure thread pools explicitly for production.

• Scheduled jobs run on every instance unless you add distributed locking (for example ShedLock).

• Cache with an eviction plan, or data goes stale.

Checkpoint

• Why might @Async appear to run synchronously?

12. Modern and Additional Topics

• Virtual threads (Java 21+): spring.threads.virtual.enabled=true; great for blocking I/O, not CPU-bound work.

• Observability: Micrometer metrics, tracing via OpenTelemetry, correlating logs, metrics and traces.

• Native image and AOT: GraalVM builds, with limits on reflection and dynamic proxies.

• Package structure: package-by-feature over package-by-layer; optionally Spring Modulith.

• Jakarta namespace: Boot 3 uses jakarta.* and requires Java 17+.

Recommended additions

• REST clients: RestClient, WebClient, HTTP interfaces

• Database migrations: Flyway or Liquibase

• API docs: OpenAPI / springdoc

• Resilience: timeouts, retries, circuit breakers (Resilience4j)

• Messaging: Kafka or RabbitMQ basics

• Deployment: layered JARs, Docker or buildpacks, health probes

• Reactive stack (optional): WebFlux and Reactor

Capstone projects

1. REST API: entities with relationships, DTOs, validation, global error handling, pagination.

2. Secured version: Spring Security with JWT, roles and method-level authorization.

3. Production-ready version: caching, scheduled cleanup, events, Actuator and Micrometer, Testcontainers tests, Docker image.

One-page mental model

• Container: builds and wires beans.

• Boot: chooses beans for you based on conditions.

• Proxies: add transactions, caching, async and security around beans.

• MVC: maps HTTP to controller methods through converters.

• Data JPA: repositories over a persistence context, inside a transaction.

• Security: a filter chain in front of everything.

• Tests: slice the context to the layer under test.