Skip to main content

r/SpringBoot

Feed About
Best
Open sort options
Change post view
What's the best way to learn Spring Security? Do's and Don'ts?
u/Bright_Picture1074
What's the best way to learn Spring Security? Do's and Don'ts?
How-To/Tutorial

Note: I used AI to polish the wording of this post, but the question and intent are mine.

I've been learning Spring Boot for a while and now I want to start with Spring Security. There are so many tutorials (JWT, OAuth2, sessions, roles, filters, etc.) that I'm not sure what's the right order to learn things.

For those of you who've already been through it:

  • What are the do's and don'ts when learning Spring Security?

  • What concepts should I understand first before jumping into JWT and OAuth2?

  • Any common mistakes beginners make that I should avoid?

  • Are there any projects that helped everything finally "click" for you?

I'm looking for advice based on real experience rather than just another YouTube playlist.

Thanks!

Advertisement: Meet ChatGPT Voice
Meet ChatGPT Voice
media poster
chatgpt.com
Learn More
After nearly 10 years with Spring Boot, this is how I’d learn it from scratch today
u/aumiom
After nearly 10 years with Spring Boot, this is how I’d learn it from scratch today
How-To/Tutorial

I keep seeing people ask for the “best Spring Boot course” or roadmap.

Honestly, I wouldn’t spend weeks watching tutorials.

Learn only enough Java and Spring Boot to build one basic CRUD application, then start coding.

Build something simple like an Employee Management API:

  • Create employee

  • Get employee by ID

  • List employees

  • Update employee

  • Delete employee

While building it, learn these concepts in this order:

  1. Controller, service and repository layers

  2. REST methods and HTTP status codes

  3. DTOs and request validation

  4. Global exception handling

  5. JPA relationships and database migrations

  6. Basic Spring Security

  7. Unit and integration testing

  8. Docker and deployment

That one project will teach you more than watching 20 hours of videos.

After CRUD, add features one by one:

  • Pagination and filtering

  • Authentication

  • Role-based authorization

  • Audit fields

  • Caching

  • Background jobs

  • File uploads

The biggest beginner mistake is trying to understand the entire Spring ecosystem before building anything. You don’t need Kafka, microservices, Kubernetes or complex design patterns for your first project.

Build a boring monolith first. Make it clean, testable and deploy it somewhere.

My rule is: use tutorials to unblock yourself, not as a substitute for building.

For experienced Spring Boot developers here: what is the one thing you wish beginners would focus on earlier?

Do people really think everyone’s going to ditch Project Reactor for Project Loom and rewrite their legacy systems just to go back to blocking code?
u/FirstExtent2079
Do people really think everyone’s going to ditch Project Reactor for Project Loom and rewrite their legacy systems just to go back to blocking code?
Discussion
Do people really think everyone’s going to ditch Project Reactor for Project Loom and rewrite their legacy systems just to go back to blocking code?
r/softwarearchitecture •
Do people really think everyone’s going to ditch Project Reactor for Project Loom and rewrite their legacy systems just to go back to blocking code?

I don’t wish to type that long tbh. However, I’ll try.

I’ve been seeing a lot of comments suggesting that Project Loom will make Project Reactor obsolete because you can just write synchronous-looking code with virtual threads.
But are companies actually going to migrate large, battle-tested Reactor-based systems? Many organizations have spent years building reactive architectures around Reactor, R2DBC, WebFlux, reactive messaging, and other non-blocking APIs. Those systems are stable, well-tested, and developers have built expertise around them.
Even if Loom simplifies concurrency, does it really justify rewriting or significantly refactoring existing production systems just to write blocking-style code again?
I understand that Loom is a great fit for many new applications and can reduce the complexity of asynchronous programming. But for mature Reactor-based systems, is there enough real-world benefit to justify the migration cost?
I’m curious what people working on large Java codebases are actually seeing in production. Are companies actively replacing Reactor with Loom, or are they treating Loom as another tool for new services while leaving existing reactive systems as they are?

upvotes comments