DEV Community: Nikhil Soman Sahu

Vaadin vs Frontend Frameworks: A Java Developer’s Sarcastic Survival Guide

Nikhil Soman Sahu — Sat, 17 May 2025 07:15:10 +0000

Subtitle: Because Sometimes You Just Want to Write Code, Not Fight JavaScript Demons

“Hey, why don’t you just use React with TypeScript, Webpack, Babel, Vite, Tailwind, and Docker to build a simple contact form?”

— Every frontend developer ever.

As a senior Java developer, I’ve spent years in the warm, type-safe embrace of the JVM. Life was simple. A little Spring Boot here, some Hibernate there, and boom—robust backend magic. Then someone said: “Let’s make it a web app.”

Great. Suddenly, I was knee-deep in JavaScript frameworks, where every library has 17 versions, 84 breaking changes, and documentation written by a caffeine-fueled squirrel.

Enter Vaadin. The messiah for backend developers who just want to build web apps without dealing with the frontend circus.

🤹‍♂️ Frontend Tech Stack Today: Welcome to the JavaScript Carnival

Let’s paint a picture.

You want a simple UI: a form, a button, a table. What do you need?

React (or Vue or Angular… pick your poison)
TypeScript (because JavaScript wasn’t confusing enough)
Node.js (to npm install 1,200 dependencies)
Webpack (because nothing screams "simple" like 3,000 lines of config)
Babel (so you can write modern JS and watch it turn into ancient hieroglyphs)
Tailwind (if you're into writing class names longer than your actual content)

Oh, and don’t forget to make everything responsive, secure, reactive, and testable.

By now, your “simple” UI has its own dev server, build system, and full-stack deployment pipeline. Bravo. 👏

😎 Meanwhile in VaadinLand...

You open your Java IDE. You write this:

@Route("")
public class MainView extends VerticalLayout {
    public MainView() {
        TextField name = new TextField("Your name");
        Button button = new Button("Greet");
        add(name, button);

        button.addClickListener(e -> {
            add(new Label("Hello, " + name.getValue()));
        });
    }
}

And guess what? That’s it. It works. No npm. No webpack. No JavaScript. Just glorious, type-safe Java.

Welcome to Vaadin. The frontend framework that doesn’t pretend you have time to learn a new ecosystem every 3 months.

🧩 What Is Vaadin, Really?

Vaadin is a Java-based UI framework that lets you build modern web apps entirely in Java.

Unlike traditional frontend frameworks that dump half the logic on the browser and half on the server (like a bad divorce), Vaadin takes a server-side-first approach.

There Are Two Flavors of Vaadin:

Vaadin Flow – Pure Java UI (no JS needed).
Vaadin Fusion – Use TypeScript for frontend if you miss the chaos.

We’ll focus on Flow because it’s the one that makes you feel like a wizard casting spells with Java.

🔥 Why Vaadin Is a Backend Developer's Dream

✅ No JavaScript

No npm install, no yarn.lock, no wondering why your build broke after a minor version update.

✅ Component-based UI

Need a table? Use Grid<>. Need a dialog? Use Dialog. No CSS classes required. It just works.

✅ Spring Boot Integration

Add the Vaadin dependency and keep coding in the warm Spring Boot cocoon.

✅ Secure by Default

All UI logic runs server-side, so your business logic isn’t sitting in a browser console for hackers to giggle at.

✅ Modern UX

Vaadin uses Web Components under the hood and provides responsive, mobile-friendly layouts—without you touching a single media query.

👨‍🔧 But… Is It for Real-World Projects?

You bet. Vaadin is used in:

Admin dashboards
ERP systems
Intranet tools
Banking apps
Basically, anywhere a dropdown actually matters more than a dancing button

It's not a toy. It's an enterprise-grade toolkit that lets you focus on business logic instead of messing with toolchains from the seventh circle of frontend hell.

🤯 Frontend Comparison Table

Feature	React + Friends 😬	Vaadin 🧘‍♂️
Language	JS/TS	Java
Framework Complexity	High	Low
Setup Time	~1-2 days	5 minutes
UI Development	Manual + CSS	Component-based
Backend Integration	REST, GraphQL	Direct Java binding
Build Tool	Webpack/Vite	Maven/Gradle
Security	Client-heavy	Server-side by default
Debugging	Console.logs + browser devtools	Stack traces like God intended
Productivity	Depends on caffeine	Smooth sailing with Java

🐍 Myth-Busting: Vaadin Edition

❌ “Vaadin is outdated.”

Reality: Vaadin constantly evolves. It now supports reactive endpoints, Hilla (Fusion), and even uses Web Components.

❌ “It’s too heavyweight.”

Reality: You’re not shipping Electron here. It’s leaner than most modern JS stacks when done right.

❌ “No one uses it.”

Reality: Ever heard of NASA, Dell, or the European Space Agency? Yep, they’ve used Vaadin.

🧙‍♂️ Final Thoughts from a Battle-Hardened Java Developer

I didn’t choose Vaadin. Vaadin chose me—when I grew tired of spending 3 hours aligning a button in CSS.

If you:

Know Java,
Hate fighting with frontend build tools,
Prefer writing clean, maintainable code,
And want your UI to just work without rituals and sacrifices,

Then Vaadin is your best friend.

Frontend frameworks may come and go, but Java is eternal—and now it builds UIs too. 😏

🧪 Want to Try It?

mvn -n vaadin-archetype-application
cd your-app
mvn

Open the browser. Watch the magic.

🤔 `spring.kafka.consumer.fetch-min-size` Not Applying? Let’s Talk About It.

Nikhil Soman Sahu — Sat, 05 Apr 2025 17:41:20 +0000

So you’re building a Spring Boot Kafka consumer, tweaking those sweet application.properties, and then you drop this gem:

spring.kafka.consumer.fetch-min-size=524288000

You’re expecting Kafka to fetch a minimum of 500 MB of data per request. Bold. Ambitious. Legendary.

But wait… Spring Boot completely ignores it. Like your gym membership.

Let’s decode what’s going on, shall we?

😤 “Why Is This One Property Not Working?”

That’s the million-dollar (or in this case, 500MB) question.

Here’s what’s wild — other Kafka consumer properties from application.properties are working just fine.

But fetch-min-size? It's like that one rebellious teenager who refuses to follow the rules.

🔍 Let’s Reproduce the Problem

Your properties probably look like this:

spring.kafka.bootstrap-servers=localhost:9092
spring.kafka.consumer.group-id=my-group
spring.kafka.consumer.auto-offset-reset=earliest
spring.kafka.consumer.key-deserializer=org.apache.kafka.common.serialization.StringDeserializer
spring.kafka.consumer.value-deserializer=org.apache.kafka.common.serialization.StringDeserializer
spring.kafka.consumer.fetch-min-size=524288000

And yet… logs, debug prints, everything shows this property isn’t being passed to the Kafka consumer.

No errors. No warnings. Just silent betrayal.

🎯 The Real Problem

Brace yourself.

fetch.min.bytes is not a recognized Spring Boot Kafka shortcut property.

Yeah. That’s why.

While Spring Boot maps many Kafka consumer properties automatically, it doesn't include all of them with auto-magic.

Some properties—especially advanced ones like fetch.min.bytes—must be set manually using the properties map.

🛠 The Fix: Do It Yourself (DIY Style)

Update your application.properties like this:

spring.kafka.consumer.properties.fetch.min.bytes=524288000

Yes. That extra properties. prefix tells Spring Boot:

“Hey, this isn’t a Spring-managed config, just pass it directly to Kafka’s native consumer config.”

And suddenly… it works. 🎉

🧠 Little Kafka Config Lesson

Kafka Property	Spring Boot Equivalent	Notes
`group.id`	`spring.kafka.consumer.group-id`	Supported directly
`auto.offset.reset`	`spring.kafka.consumer.auto-offset-reset`	Supported directly
`fetch.min.bytes`	❌ Not mapped by Spring Boot	Must be used as `spring.kafka.consumer.properties.fetch.min.bytes`

📚 Want to see the full list of what’s supported? Check the Spring Kafka docs.

🙋🏻‍♂️ “Why Doesn’t Spring Boot Just Support All Kafka Properties?”

Good question.

Because:

Kafka has dozens of knobs
Spring Boot tries to keep its abstraction layer clean
Not every project needs fine-tuning at this level

So for lesser-used Kafka settings, Spring leaves it to you, brave dev, to add them manually via the properties. namespace.

🧪 How to Confirm It’s Working

Enable DEBUG logging for Kafka:

logging.level.org.apache.kafka=DEBUG
logging.level.org.springframework.kafka=DEBUG

Start the app, and look for this beauty in logs:

Setting fetch.min.bytes to 524288000

If you see it, go ahead and flex a little 💪.

😅 A Word of Caution

A fetch.min.bytes of 500 MB is huge. If you’re not producing large volumes quickly, your consumer might just sit there... waiting... forever.

Kafka will not send data until that threshold is reached or fetch.max.wait.ms times out (default: 500ms).

So unless you’re processing massive data bursts, you might wanna start with a saner value like 1048576 (1 MB).

But hey, who am I to judge your buffer goals? 😎

💡 Final Thoughts

If Kafka consumer properties aren't applying as expected, don't assume they're broken. Instead:

Double-check the Spring Boot Kafka property reference
Use the spring.kafka.consumer.properties. prefix for advanced Kafka configs
Watch your logs—they usually know what’s wrong (and laugh quietly while you suffer)

🔗 Quick Recap

✔️ spring.kafka.consumer.fetch-min-size ❌

✔️ spring.kafka.consumer.properties.fetch.min.bytes=... ✅

📣 Bonus Tip

If you're ever unsure whether a config is being applied, inject and print the full ConsumerFactory like this:

@Autowired
private ConsumerFactory<?, ?> consumerFactory;

@PostConstruct
public void printKafkaConfigs() {
    System.out.println(consumerFactory.getConfigurationProperties());
}

It’ll dump all the consumer config Kafka is using. Use it to debug like a boss. 🧠

🤘 That’s a Wrap!

Kafka is powerful, but it doesn’t hand-hold you—especially when it comes to advanced configs.

Now that you know the trick with properties., you’ve got one less mysterious bug in your life.

Got stuck with another Kafka quirk? Hit me up—I’ve probably wrestled with it at 2AM and lived to tell the tale.

Until next time: keep producing, keep consuming, and may your partitions never be under-replicated. 🫡

100 imp interview questions for Java developers

Nikhil Soman Sahu — Fri, 04 Apr 2025 19:18:44 +0000

Core Java

What is the difference between == and .equals() in Java?
Explain the concept of immutability in Java.
What is the purpose of the final keyword in Java?
How does Java achieve platform independence?
What is the difference between String, StringBuilder, and StringBuffer?
Explain the concept of method overloading and overriding.
What is the use of the super keyword in Java?
How do you handle exceptions in Java? Explain try-catch-finally.
What is the difference between checked and unchecked exceptions?
What is the purpose of the static keyword in Java?
Can you overload the main method in Java? If yes, how?
What is the difference between ArrayList and LinkedList?
How does Java garbage collection work?
What is the difference between HashMap and Hashtable?
Explain the concept of multithreading in Java.
What are the different ways to create threads in Java?
What is the difference between sleep() and wait()?
What is the purpose of the volatile keyword?
How does Java support encapsulation?
What is the difference between an abstract class and an interface?
Can we instantiate an abstract class? Why or why not?
What is the difference between compareTo() and compare()?
What is autoboxing and unboxing in Java?
What is the difference between transient and volatile keywords?
What is the purpose of the Object class in Java?

Collections Framework

What is the difference between List, Set, and Map?
How does HashSet ensure uniqueness of elements?
What is the time complexity of operations in ArrayList vs LinkedList?
What is the difference between Iterator and ListIterator?
How does TreeSet maintain sorting order?
What happens if we add a null value to a HashMap?
What is the difference between poll() and remove() in Queue?
Explain the working of ConcurrentHashMap.
What is the difference between fail-fast and fail-safe iterators?
How does PriorityQueue work?
What is the difference between Comparable and Comparator?
What is the purpose of the retainAll() method in collections?
How does Vector differ from ArrayList?
What is the difference between keySet() and entrySet() in Map?
How do you sort a List of custom objects?

Java 8 Features

What are lambda expressions in Java?
What is a functional interface? Give examples.
What is the difference between forEach and for-loop?
Explain the concept of streams in Java.
What is the difference between map() and flatMap()?
What are default methods in interfaces?
What is the purpose of the Optional class?
How does Stream.collect() work?
What are method references in Java?
What is the difference between intermediate and terminal operations in streams?

OOPs Concepts

What is polymorphism? Explain its types.
What is inheritance? What are its advantages and disadvantages?
What is the difference between composition and aggregation?
What is the diamond problem in Java? How is it resolved?
What is the difference between this and super?
What is the difference between abstract classes and interfaces in Java 8+?
What is encapsulation? Why is it important?
What is the difference between private, protected, and public access modifiers?
What is the purpose of the toString() method?
What is the difference between instanceof and isInstance()?

Advanced Java

What is the difference between JVM, JRE, and JDK?
What is reflection in Java? Provide an example.
What is the purpose of annotations in Java?
What is the difference between ClassNotFoundException and NoClassDefFoundError?
What is the difference between String pool and heap memory?
What is the purpose of the ClassLoader in Java?
What is the difference between serializable and externalizable?
What is the purpose of the clone() method?
What is the difference between shallow copy and deep copy?
What is the purpose of the finalize() method?

Concurrency and Multithreading

What is the difference between Runnable and Callable?
What is the purpose of the ExecutorService?
What is thread pooling? Why is it used?
What is the difference between synchronized and ReentrantLock?
What is the difference between start() and run() methods in threads?
What is thread starvation? How can it be avoided?
What is a deadlock? How can it be prevented?
What is the purpose of ThreadLocal?
What is the difference between notify() and notifyAll()?
What is the purpose of the ForkJoinPool?

Spring Framework (if applicable)

What is dependency injection? How does Spring implement it?
What is the difference between @Autowired and @Qualifier?
What is the difference between @Component, @Service, and @Repository?
What is the purpose of the @Transactional annotation?
What is Spring Boot? How is it different from Spring Framework?
What is the purpose of the application.properties file?
What is the difference between singleton and prototype scopes in Spring?
What is AOP (Aspect-Oriented Programming)?
What is the difference between @Controller and @RestController?
What is the purpose of the DispatcherServlet?

Hibernate (if applicable)

What is the difference between get() and load() in Hibernate?
What is lazy loading? How does it work?
What is the purpose of the SessionFactory in Hibernate?
What are the different states of an entity in Hibernate?
What is the difference between save() and persist()?
What is the purpose of the @Entity annotation?
What is HQL (Hibernate Query Language)?
What is the difference between merge() and update()?
What is the second-level cache in Hibernate?
What is the purpose of the @Transactional annotation in Hibernate?

Claude Code: The AI Terminal Sidekick We've Been Waiting For

Nikhil Soman Sahu — Wed, 02 Apr 2025 05:44:36 +0000

Hey devs! Just spent my weekend playing with Anthropic's new Claude Code tool, and I HAD to share this gem with you all. For those who haven't heard, it's an AI command line tool that lets you talk to Claude directly from your terminal. Game. Changer.

No More Alt-Tabbing to Chat Interfaces

First thing I noticed? I'm staying in my terminal WAY more. We've all been there - coding away, hit a snag, then alt-tab to a browser to ask Claude or search Stack Overflow. With Claude Code, I just type my question right where I'm already working. My flow state actually stays intact!

# Instead of leaving your terminal to get help
$ claude-code "refactor this function to use async/await instead of promises"

The Stuff It Can Actually Do

I've had it:

Generate unit tests for a sketchy module I inherited (saved me hours)
Help optimize a MongoDB query that was killing our staging environment
Refactor some legacy jQuery spaghetti into modern React components
Debug a weird race condition I couldn't reproduce consistently

The coolest part? It actually understands my codebase context. It's not just spitting out generic Stack Overflow answers.

When It Really Saved My Bacon

Friday evening (of course), I was stuck debugging this authentication edge case nobody else wanted to touch. Had a deployment deadline looming, and my brain was fried after a week of meetings. Asked Claude Code to analyze the flow and spot potential issues - it immediately identified a token refresh timing problem I had completely missed.

Three lines of code later, fixed. Deployment saved. Weekend reclaimed.

Real Talk: It's Not Perfect

It sometimes gets confused with really complex project structures or highly domain-specific code. And occasionally I need to clarify what I'm asking for. But compared to the back-and-forth of web interfaces, even these interactions feel smoother.

Should You Try It?

If you're tired of context-switching between your IDE/terminal and browser windows, absolutely. Especially useful for:

Those repetitive coding tasks nobody wants to do
Diving into unfamiliar codebases or frameworks
Late-night debugging sessions when your brain is toast

Anyone else playing with this tool yet? Drop your experiences in the comments - curious how you're using it and what tasks it's best at handling for you!

P.S. Check Anthropic's blog for details on the research preview. Not sure when it's going fully public, but worth getting on the waitlist now.

Deploying Spring Boot 3.1 on Heroku with Tomcat 10.1

Nikhil Soman Sahu — Wed, 02 Apr 2025 05:29:28 +0000

Introduction

Deploying a Spring Boot 3.1 application on Heroku with Tomcat 10.1 might seem tricky at first, but with the right steps, you can get your application running smoothly on a cloud-based platform. In this guide, we’ll walk through the entire process, ensuring a seamless deployment.

Why Deploy Spring Boot on Heroku?

Heroku provides a simple and scalable cloud platform for deploying applications. Some key advantages include:

Free tier available: Great for development and testing.
Simplified deployment: Just push your code to Git, and Heroku handles the rest.
Scalability: Scale your application with ease as traffic grows.
Built-in support for Java: Heroku natively supports Java, making it easier to deploy Spring Boot apps.

Step 1: Prepare Your Spring Boot Application

Before deploying, ensure that your Spring Boot 3.1 application meets these requirements:

Uses Tomcat 10.1 as the embedded server.
Configured with PostgreSQL or any other database compatible with Heroku.
Includes a Procfile for Heroku execution.

Add Dependencies

Update your pom.xml with the necessary dependencies for Spring Boot and Tomcat:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>10.1.0</version>
</dependency>

Step 2: Configure Heroku for Deployment

1. Install the Heroku CLI

If you haven’t already, install the Heroku CLI:

curl https://cli-assets.heroku.com/install.sh | sh

2. Login to Heroku

Run the following command:

heroku login

This opens a browser window for authentication.

3. Create a New Heroku App

In your project root directory, initialize a new Heroku app:

heroku create your-app-name

Replace your-app-name with a unique name.

Step 3: Configure the Procfile

Heroku requires a Procfile to specify the process type. Create a file named Procfile in your project root and add:

web: java -jar target/your-app.jar

Replace your-app.jar with the actual name of your built JAR file.

Step 4: Configure Application Properties

Heroku provides environment variables for configurations. Update your application.properties or application.yml:

server.port=${PORT}
spring.datasource.url=${JDBC_DATABASE_URL}
spring.datasource.username=${JDBC_DATABASE_USERNAME}
spring.datasource.password=${JDBC_DATABASE_PASSWORD}

Step 5: Deploy to Heroku

1. Initialize Git

If your project is not already a Git repository, initialize it:

git init
git add .
git commit -m "Initial commit"

2. Deploy to Heroku

git push heroku main

After deployment, Heroku assigns a URL to your app. You can check the status with:

heroku logs --tail

3. Scale the App

Heroku automatically assigns a free-tier dyno to your application. If needed, scale it:

heroku ps:scale web=1

Step 6: Open Your Application

Once deployed, open your application in a browser:

heroku open

This should load your Spring Boot 3.1 application running on Tomcat 10.1!

Conclusion

Deploying a Spring Boot 3.1 application on Heroku with Tomcat 10.1 is straightforward. By following these steps, you can leverage Heroku’s cloud infrastructure to run your applications efficiently with minimal setup.

🚀 Next Steps: Explore Heroku’s PostgreSQL integration, auto-scaling, and log monitoring for a more robust deployment!

Got questions or need help? Drop a comment below and let's discuss! 🚀

How to Host a Web App for Free

Nikhil Soman Sahu — Wed, 02 Apr 2025 05:04:54 +0000

Have you ever built an awesome web app, only to realize that hosting can be expensive? Well, what if I told you that you can deploy a fully functional, production-ready web app for FREE? No gimmicks, no trial periods—just smart choices.

In this guide, I’ll walk you through the best free hosting platforms for frontends, backends, databases, and even CI/CD. By the end, you’ll have everything you need to launch your web app without spending a dime. 🚀

🎯 Step 1: Choose the Right Hosting for Your App

Not all free hosting services are equal. The best one depends on what you’re building. Here’s a quick breakdown:

App Type	Best Free Hosting Option
Static Sites (HTML, CSS, JS)	GitHub Pages, Netlify, Cloudflare Pages
React, Vue, Angular Apps	Vercel, Netlify, Cloudflare Pages
Node.js/Python/Django APIs	Railway, Render, Fly.io
Full-Stack Apps	Railway, Render, Fly.io
Databases (PostgreSQL, MongoDB)	NeonDB, Supabase, MongoDB Atlas

Let’s dive deeper into each option. 🔥

🔹 Frontend Hosting (For Static & JS Framework Apps)

1️⃣ GitHub Pages (For Static Sites)

✅ Best for: Simple static websites, portfolios, documentation.
✅ Free Features:

Host static files with a custom domain.
Automatic HTTPS.
Unlimited bandwidth.

📌 How to Deploy:

Push your project to a GitHub repo.
Go to Settings → Pages.
Select the branch and folder to deploy.
Your site will be live at https://yourusername.github.io/reponame/.

2️⃣ Vercel (For React, Next.js, Vue)

✅ Best for: Frontend frameworks like Next.js, React, Vue, and Svelte.
✅ Free Features:

Automatic CI/CD (just push to GitHub, and it deploys).
Serverless API support (Edge Functions).
Global CDN for fast performance.

📌 How to Deploy:

npm i -g vercel
vercel

🚀 Done! You’ll get an instant live URL.

Alternative: Netlify (better for Jamstack apps, similar features).

🔹 Backend Hosting (For APIs & Full-Stack Apps)

3️⃣ Railway.app (For Node.js, Python, Django, Spring Boot)

✅ Best for: Full-stack web apps with backend APIs.
✅ Free Features:

500 hours/month of free runtime (~21 days of continuous usage).
PostgreSQL and MySQL databases.
Simple Git-based deployment.

📌 How to Deploy:

railway up  # Automatically deploys backend

🚀 Boom! Your backend is live.

Alternatives: Render (better uptime), Fly.io (for Dockerized apps).

🔹 Free Database Hosting (For Storing App Data)

Database	Free Tier Features
MongoDB Atlas	512MB storage, 100 concurrent connections
Supabase (PostgreSQL)	500MB database, RESTful API
NeonDB (PostgreSQL)	1GB free, automatic scaling
PlanetScale (MySQL)	5GB storage, 10M row reads/month

📌 How to Connect Your App to a Free Database:

export DATABASE_URL="your-free-db-url"

🔗 Now your backend can communicate with the database!

🔹 CI/CD for Automatic Deployments (No Manual Work!)

4️⃣ GitHub Actions (For Auto-Deployments)

✅ Best for: Automating deployments every time you push code.
✅ Free Features:

Unlimited private repositories.
2,000 minutes/month of free CI/CD.

📌 Example: Auto-Deploy to Vercel

name: Deploy to Vercel
on:
  push:
    branches:
      - main
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: npm install -g vercel
      - run: vercel --prod

🔄 Every time you push code to main, your site updates automatically!

🔹 Free Domain & SSL (For a Professional Touch)

Want a custom domain (not just yourapp.vercel.app)?

✅ Free Options:

Freenom → Free .tk, .ml, .ga domains.
Cloudflare → Free SSL & DNS management.
InfinityFree → Free cPanel hosting + free subdomain.

📌 How to Connect a Custom Domain:

Get a free domain from Freenom.
Use Cloudflare for free HTTPS and DNS management.
Link it to your hosting provider (Vercel, Netlify, etc.).

Now your site looks 100% professional with SSL encryption! 🔒✨

🎯 Final Free Hosting Stack (Fully Production-Ready!)

Layer	Best Free Option
Frontend Hosting	Vercel / Cloudflare Pages
Backend Hosting	Railway / Render / Fly.io
Database	NeonDB (PostgreSQL) / MongoDB Atlas
CI/CD	GitHub Actions / GitLab CI/CD
Custom Domain	Freenom + Cloudflare

🚀 Final Thoughts: Is This Truly "Production-Ready"?

✅ Yes, but there are some trade-offs:

Cold starts (some services may sleep after inactivity).
Free limits (like compute hours or bandwidth).
Database size restrictions (good for MVPs, but not for huge traffic apps).

💡 Pro Tip: Use Cloudflare caching and serverless functions to reduce backend load and improve performance!

Are you ready to deploy your web app for free? Drop a comment below if you have any questions! 🚀

Understanding LinkedIn Authwall: How it Works, Benefits, and Implementing it on Your Website

Nikhil Soman Sahu — Tue, 05 Nov 2024 15:42:07 +0000

The LinkedIn Authwall is a protective access layer that LinkedIn has implemented to manage the visibility of content and safeguard user information. This feature restricts access to certain content on LinkedIn to only authenticated (logged-in) users. In recent years, it has become a crucial tool for controlling content access on LinkedIn and ensuring a layer of privacy for its users. This article will dive into how LinkedIn Authwall works, its benefits, and how similar mechanisms can be implemented on your own website.

What is LinkedIn Authwall?

The LinkedIn Authwall is a security mechanism that serves as an "authentication wall," preventing anonymous users from accessing specific pages or content. LinkedIn restricts certain profile and feed information behind this authwall, meaning visitors who are not logged in cannot see the content without first creating an account or logging in.

This approach is widely used in several scenarios:

Viewing LinkedIn profiles.
Accessing posts and comments.
Reading in-depth articles from LinkedIn News.

The LinkedIn Authwall can be considered a type of “soft paywall” or “sign-up gate,” commonly used by social media platforms and content providers to increase engagement and control content distribution.

How Does LinkedIn Authwall Work?

Request Interception: When an anonymous user (not logged in) tries to access protected content, LinkedIn’s backend intercepts the request. The platform assesses if the user is authenticated.
Authentication Check: The LinkedIn server checks if there’s a valid session for the user (indicating they’re logged in). If not, the server redirects the user to the LinkedIn login or registration page.
Session Validation: Upon successful login, LinkedIn generates a session cookie for the user. This cookie grants them access to the previously restricted content for that browsing session.
Re-authentication After Timeout: To prevent abuse, the authwall can enforce a re-authentication process if the session expires or if the user logs out. This ensures that sensitive information is only accessible to verified users.

Benefits of LinkedIn Authwall

The LinkedIn Authwall has several benefits, both for LinkedIn as a platform and for its users:

Privacy Protection: Authwall provides a layer of privacy, protecting users' data from being scraped or accessed by anonymous visitors. Only authenticated users can access certain information, reducing unauthorized data collection.
User Engagement: By requiring users to log in, LinkedIn encourages greater engagement. Once users are logged in, they’re more likely to interact with content, add connections, or engage with posts.
Data Collection: LinkedIn gathers essential metrics from logged-in users, such as browsing behavior, search terms, and interaction patterns. These insights can be used to enhance personalization, ad targeting, and platform improvements.
Enhanced Security: Authwall prevents automated bots from accessing user information, which reduces spam and improves the overall security of user data on the platform.
Growth in User Base: Requiring logins to view certain content can incentivize new users to sign up. LinkedIn has grown its user base partly by creating valuable content that users need to be logged in to view.

Implementing an Authwall on Your Website

If you’re interested in implementing an authwall on your website to protect specific content and increase user engagement, here are some steps and considerations:

1. Identify Content to Protect

Determine what content should be available to only authenticated users. For example:
- User profiles
- Articles, reports, or premium resources
- Community forums or comment sections
Sensitive data or subscription-based content is often a prime candidate for authwall protection.

2. Set Up User Authentication

Implement a robust authentication system. This can include:
- Sign-Up/Login Form: Allow users to create an account or log in to access restricted content.
- OAuth Integration: Use OAuth for a secure and convenient login process with other platforms (e.g., Google, Facebook).
Use session tokens or cookies to track authenticated users.

3. Redirect Unauthenticated Users

When an unauthenticated user requests protected content, intercept the request and redirect them to a login or registration page.
After successful login, redirect the user back to their desired content.

4. Session Management and Security

Ensure that user sessions are properly managed, with secure session tokens to prevent unauthorized access.
Consider using techniques like session expiration and multi-factor authentication for added security.

5. UX Considerations

Implement a smooth UX flow for the authwall. Offer a clear message explaining why the user needs to log in.
If using a soft paywall approach, consider allowing users to view limited content before requiring login.

Example Code for Implementing an Authwall in Node.js (Express)

Here’s a simple example of how you could implement an authwall for a Node.js-based website using Express.

const express = require('express');
const session = require('express-session');

const app = express();

// Middleware to check if the user is authenticated
function authWall(req, res, next) {
    if (!req.session.user) {
        return res.redirect('/login');
    }
    next();
}

// Setting up session middleware
app.use(session({
    secret: 'your-secret-key',
    resave: false,
    saveUninitialized: true,
}));

// Login route
app.get('/login', (req, res) => {
    res.send('Please log in to access this content');
});

// Protected route (with authwall)
app.get('/protected-content', authWall, (req, res) => {
    res.send('You have accessed protected content');
});

// Simulate login (for demonstration purposes)
app.post('/login', (req, res) => {
    req.session.user = { id: 1, name: 'John Doe' }; // Mock user session
    res.redirect('/protected-content');
});

app.listen(3000, () => console.log('Server running on http://localhost:3000'));

In this example:

authWall middleware checks if the user session exists. If not, it redirects the user to the login page.
If the user is logged in, they are allowed to access protected content.

6. Monitor User Engagement

Track metrics like login frequency, content views, and user retention to understand how effective the authwall is in driving engagement.

Conclusion

The LinkedIn Authwall serves as an effective mechanism to protect user privacy, increase engagement, and manage access to content. By limiting content access to authenticated users, LinkedIn successfully enhances user interaction and improves data security.

By applying a similar authwall mechanism on your website, you can protect sensitive content, encourage users to register, and foster a more engaged audience. While implementing an authwall requires thoughtful planning and technical implementation, the benefits in terms of security, privacy, and user experience make it a worthwhile addition to many types of websites.

Mastering Encapsulation in Java: A Comprehensive Guide with Examples

Nikhil Soman Sahu — Thu, 24 Oct 2024 05:20:02 +0000

A Detailed Guide to Java Encapsulation

Encapsulation is one of the four fundamental OOP (Object-Oriented Programming) principles in Java, alongside inheritance, polymorphism, and abstraction. Encapsulation refers to bundling the data (attributes) and the methods that manipulate that data (behavior) into a single unit or class. In addition to bundling, encapsulation also involves restricting direct access to some of an object’s components, which is typically achieved through access modifiers.

In this article, we'll explore the concept of encapsulation in Java, its importance, practical examples, and how to implement it in your code effectively.

1. What is Encapsulation?

Encapsulation in Java can be understood as the technique of hiding the internal details of an object and only exposing selected information to the outside world. It helps protect the internal state of an object from unintended or harmful changes by ensuring that the data cannot be accessed directly but can only be modified through well-defined methods.

Encapsulation ensures data hiding, which means restricting access to some of the class's variables and methods from outside the class, preventing accidental or malicious tampering with the object's state.

2. Key Components of Encapsulation

To implement encapsulation in Java, we generally use two main components:

Private Fields: These are the attributes or instance variables of a class, marked private to restrict direct access.
Public Methods: These methods are the interface to the class’s private fields. Typically, we use getter and setter methods to read and modify the values of the private fields.

3. Encapsulation in Action: A Practical Example

Consider a real-world scenario where we want to manage the details of a Student class. Here's how encapsulation can be used to protect the student's data:

public class Student {

    // Private fields (Data hiding)
    private String name;
    private int age;
    private String grade;

    // Constructor
    public Student(String name, int age, String grade) {
        this.name = name;
        this.age = age;
        this.grade = grade;
    }

    // Public getter for 'name'
    public String getName() {
        return name;
    }

    // Public setter for 'name'
    public void setName(String name) {
        this.name = name;
    }

    // Public getter for 'age'
    public int getAge() {
        return age;
    }

    // Public setter for 'age' with a validation
    public void setAge(int age) {
        if (age > 0) {
            this.age = age;
        } else {
            System.out.println("Please provide a valid age.");
        }
    }

    // Public getter for 'grade'
    public String getGrade() {
        return grade;
    }

    // Public setter for 'grade'
    public void setGrade(String grade) {
        this.grade = grade;
    }

    // A method to display student details
    public void displayStudentInfo() {
        System.out.println("Name: " + this.name + ", Age: " + this.age + ", Grade: " + this.grade);
    }
}

Explanation:

Private Fields: The name, age, and grade fields are private, which means they cannot be accessed directly from outside the class.
Public Getter and Setter Methods: To access or modify the values of these fields, we provide public methods (getName(), setName(), getAge(), setAge(), etc.).
Validation: Encapsulation also allows us to validate or control the data before modifying the fields. For instance, in the setAge() method, the age is checked for a valid positive value before being set.

Usage of Encapsulation:

public class Main {
    public static void main(String[] args) {
        // Create an instance of Student
        Student student = new Student("Alice", 20, "A");

        // Access the student's details via public methods
        System.out.println("Student Name: " + student.getName());
        student.setAge(22); // Updates the age after validation
        student.displayStudentInfo();

        // Attempting invalid data modification
        student.setAge(-5); // Will prompt the validation failure message
    }
}

Output:

Student Name: Alice
Name: Alice, Age: 22, Grade: A
Please provide a valid age.

4. Advantages of Encapsulation

Encapsulation provides several significant benefits:

4.1 Control Over Data

Encapsulation allows you to control how the data is accessed and modified. This is crucial for maintaining a clean, error-free state of the object. In the example above, the setAge() method includes a validation to ensure the age cannot be negative.

4.2 Improved Security

Since the internal implementation of a class is hidden, it helps protect sensitive data from unauthorized access or modifications. Only specific parts of the code are exposed through public methods, making the class more secure.

4.3 Easy Maintenance and Flexibility

By using getter and setter methods, the internal workings of the class can be changed without affecting the external code. For example, you can change how the age is calculated internally without altering the code that uses the getAge() method.

4.4 Loose Coupling

Encapsulation ensures that classes interact with each other through well-defined interfaces. This reduces dependencies between different parts of the application and makes the code more modular, which facilitates easier debugging and unit testing.

5. Encapsulation and Java Access Modifiers

Encapsulation is tightly associated with Java's access modifiers, which help define the visibility of class members (fields and methods).

Access Modifier	Class	Package	Subclass	World
`private`	Yes	No	No	No
`default`	Yes	Yes	No	No
`protected`	Yes	Yes	Yes	No
`public`	Yes	Yes	Yes	Yes

Private: The field/method is only accessible within the same class.
Default (Package-private): Accessible within the same package but not outside.
Protected: Accessible within the same package and subclasses.
Public: Accessible from any class in any package.

6. Common Mistakes When Implementing Encapsulation

6.1 Exposing Fields Through Public Access

Developers often make the mistake of declaring fields public, which violates the principle of encapsulation. Always prefer private fields with public getter/setter methods instead.

// Bad practice
public class Employee {
    public String name;  // Should be private
    public int id;       // Should be private
}

6.2 Not Validating Inputs in Setter Methods

Without validations, encapsulation can become meaningless. Setter methods should always ensure that the data being set is valid.

6.3 Using Only Getters/Setters Without Logic

Simply having getters and setters without any business logic or validation does not fully leverage the power of encapsulation.

7. Conclusion

Encapsulation is a vital concept in Java that enhances security, maintains control over data, and improves the modularity of code. It allows you to manage how data is exposed and manipulated, providing a mechanism to protect the integrity of an object’s state. By combining private fields with public getter and setter methods, you can create robust, maintainable, and secure Java applications.

Mastering encapsulation, along with the other OOP principles like inheritance, abstraction, and polymorphism, will help you design better object-oriented systems that are scalable and easier to maintain.

Spring Boot Caching Simplified: How to Use JetCache Effectively

Nikhil Soman Sahu — Mon, 21 Oct 2024 16:49:31 +0000

Caching is a powerful technique that can drastically improve application performance by reducing the need to retrieve data from a slow data store like a database. JetCache is a Java-based caching library that integrates seamlessly with Spring Boot, providing annotations, easy configuration, and multi-level caching support (local + remote). In this article, we will explore how to use JetCache in a Spring Boot application, covering its key features and practical examples.

Why JetCache?

JetCache stands out for the following reasons:

Ease of Use: It provides simple annotations like @Cached for caching methods.
Support for Multi-Level Caching: You can configure both local (in-memory) and remote (Redis) caches easily.
Auto Configuration with Spring Boot: JetCache integrates easily with Spring Boot's auto-configuration features.
Out-of-the-Box Integration: It supports various cache providers such as Redis, Caffeine, and even custom implementations.

Key Features of JetCache

Declarative Caching: Use annotations like @Cached, @CacheInvalidate, and @CacheUpdate for caching behavior.
Multi-Level Cache: It allows using both local and remote cache providers for efficient caching strategies.
Support for Key Generation: JetCache provides automatic or custom key generation for cache entries.
TTL (Time to Live) Settings: Set expiration time for cache entries on both local and remote levels.

Let’s now dive into how to integrate JetCache into a Spring Boot application.

Step 1: Set Up the Spring Boot Project

To get started, create a new Spring Boot project with the necessary dependencies. You can use Spring Initializr or manually add the following dependencies to your pom.xml:

<dependency>
    <groupId>com.github.alicp.jetcache</groupId>
    <artifactId>jetcache-starter-redis-lettuce</artifactId> <!-- For Redis support -->
    <version>2.7.14</version>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>

<dependency>
    <groupId>com.github.ben-manes.caffeine</groupId>
    <artifactId>caffeine</artifactId> <!-- For Local Cache -->
</dependency>

Step 2: Configure JetCache in `application.yml`

spring:
  cache:
    type: none

jetcache:
  statIntervalMinutes: 5  # Statistics output interval
  areaInCacheName: false
  local:
    default:
      limit: 100  # Maximum number of entries in local cache
      expireAfterWriteInMillis: 60000  # TTL for local cache
  remote:
    default:
      type: redis
      keyConvertor: fastjson
      ttlInMillis: 300000  # 5 minutes TTL for Redis cache
      jedis:
        host: localhost
        port: 6379
        password: ""  # Add password if Redis requires authentication

Step 3: Create a Service with Caching Enabled

Let’s create a simple service that fetches user data, simulating a database query, and cache the result.

User Entity

public class User {
    private Long id;
    private String name;

    // Constructor, Getters, and Setters
    public User(Long id, String name) {
        this.id = id;
        this.name = name;
    }

    // getters and setters
}

UserService

import com.alicp.jetcache.anno.Cached;
import org.springframework.stereotype.Service;

@Service
public class UserService {

    // Simulate a database call
    @Cached(name = "userCache-", key = "#id", expire = 300, localExpire = 60)
    public User getUserById(Long id) {
        simulateSlowService();
        return new User(id, "User " + id);
    }

    // Invalidate the cache entry for the given ID
    @CacheInvalidate(name = "userCache-", key = "#id")
    public void invalidateUserCache(Long id) {
        // This method will remove the user from the cache
    }

    // Simulate a slow response (e.g., a database call)
    private void simulateSlowService() {
        try {
            Thread.sleep(3000);  // Simulate delay
        } catch (InterruptedException e) {
            throw new IllegalStateException(e);
        }
    }
}

In this service:

The @Cached annotation is used to cache the result of getUserById. The key for the cache is the id, and the cache entry will expire after 5 minutes in Redis and 1 minute in local memory.
The @CacheInvalidate annotation allows us to remove a specific entry from the cache.

Step 4: Use the Service in a Controller

Let’s expose this service via a REST controller to fetch and invalidate cached user data.

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class UserController {

    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @GetMapping("/user/{id}")
    public User getUserById(@PathVariable Long id) {
        return userService.getUserById(id);
    }

    @GetMapping("/user/{id}/invalidate")
    public String invalidateCache(@PathVariable Long id) {
        userService.invalidateUserCache(id);
        return "Cache for User ID " + id + " invalidated.";
    }
}

Step 5: Test the Caching Behavior

When you run the application, access the following endpoints:

GET /user/1: The first call will simulate a slow service and take 3 seconds to return. The result will be cached.
GET /user/1 (subsequent call): This call will return the cached result instantly from the local cache (if within 1 minute) or from Redis (if within 5 minutes).
GET /user/1/invalidate: This endpoint invalidates the cached data for the user with ID 1.

Step 6: Monitor the Cache

JetCache provides built-in statistics to monitor cache hits and misses. By default, it logs cache statistics every 5 minutes. You can configure this interval or manually output statistics using CacheMonitor.

JetCache Annotations

Let’s dive deeper into some of the key JetCache annotations:

@Cached: Caches the result of a method. Parameters:
- name: Prefix for cache key names.
- key: SpEL expression to specify cache keys.
- expire: TTL for remote cache in seconds.
- localExpire: TTL for local cache in seconds.
@CacheInvalidate: Removes an entry from the cache. Parameters:
- name: Prefix for the cache key name.
- key: SpEL expression to specify the cache key to invalidate.
@CacheUpdate: Updates an existing cache entry. You can use this for methods that modify data and should refresh the cache.

Multi-Level Caching with JetCache

JetCache supports both local and remote caches. Here’s a quick summary of how multi-level caching works:

Local Cache: Stored in memory (e.g., using Caffeine). Local cache is typically faster but has limited size.
Remote Cache: Stored in external services like Redis. Remote caches are slower but can store much larger datasets.

JetCache uses local cache first. If a cache miss occurs, it will check the remote cache (e.g., Redis). This setup offers a good balance between speed and capacity.

Best Practices for Using JetCache

Avoid Over-Caching: Cache only data that is expensive to retrieve and doesn’t change frequently.
Set Reasonable Expirations: Choose appropriate TTLs for both local and remote caches to avoid stale data.
Monitor Cache Usage: JetCache provides statistics to help you monitor cache performance. Use them to optimize your cache settings.
Consider Cache Size: Especially for local caches, ensure you have limits in place to avoid memory overflow.

Conclusion

JetCache provides a simple yet powerful way to integrate caching into your Spring Boot application. With easy-to-use annotations, support for multi-level caching, and robust integration with popular cache providers like Redis, JetCache can significantly improve your application's performance.

By following the steps in this guide, you can set up caching in your Spring Boot applications quickly and efficiently. Whether you’re caching small lookups in local memory or large datasets in Redis, JetCache has you covered.

Further Reading:

Deleting Duplicate Data from MySQL

Nikhil Soman Sahu — Mon, 23 Sep 2024 16:57:24 +0000

Hey there, 👋 Welcome to another blog post. Today, we’ll tackle something every database engineer faces at some point—deleting duplicate data in MySQL. This is a crucial skill, especially when managing large datasets where data cleanliness is vital.

Why Should We Remove Duplicates?

Imagine you’re managing a user database for a website. If users sign up multiple times due to some glitch or error, you’ll end up with duplicates. This can mess up your reports, slow down queries, and increase storage costs. So, let’s get our hands dirty and see how to remove these duplicates!

Setting Up the Scenario

Let’s start with a simple users table:

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    email VARCHAR(255) NOT NULL,
    name VARCHAR(100),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

And let’s insert some duplicate data to simulate the real-world problem:

INSERT INTO users (email, name) VALUES
('john.doe@example.com', 'John Doe'),
('jane.smith@example.com', 'Jane Smith'),
('john.doe@example.com', 'John Doe'),
('mary.jane@example.com', 'Mary Jane'),
('jane.smith@example.com', 'Jane Smith');

Now, if we run a simple query to check the data:

SELECT * FROM users;

You’ll notice there are duplicate emails. Let’s work on cleaning that up!

Step 1: Identifying Duplicates

Before we delete anything, we need to identify which rows are duplicates. One way to find duplicate entries is by using the GROUP BY clause in MySQL:

SELECT email, COUNT(*)
FROM users
GROUP BY email
HAVING COUNT(*) > 1;

This query shows you any email addresses that appear more than once.

What other ways could duplicates sneak into a table? It’s not always about emails—what else should we look out for? Comment below with your thoughts!

Step 2: Deleting Duplicates, the Safe Way

Deleting rows from a database always requires caution. In MySQL, one common trick to delete duplicate rows while keeping one copy is using a subquery combined with ROW_NUMBER(). But since MySQL (before version 8.0) doesn’t support window functions, we’ll use a more classic approach with a temporary table.

Here’s how to safely delete duplicates:

Create a Temporary Table that holds the unique rows.

CREATE TEMPORARY TABLE temp_users AS
SELECT MIN(id) AS id, email, name
FROM users
GROUP BY email, name;

Delete the Duplicates from the original table.

DELETE FROM users
WHERE id NOT IN (SELECT id FROM temp_users);

Verify the Result. Let’s make sure only unique entries remain:

SELECT * FROM users;

Boom! 🎉 You’ve removed the duplicates, leaving only one copy of each email.

Step 3: Another Method for MySQL 8.0+

If you’re using MySQL 8.0 or later, you have access to the ROW_NUMBER() function, which makes this process even easier. Let’s check it out:

WITH RankedUsers AS (
    SELECT *, ROW_NUMBER() OVER (PARTITION BY email ORDER BY id) AS rn
    FROM users
)
DELETE FROM users WHERE id IN (
    SELECT id FROM RankedUsers WHERE rn > 1
);

Here, we assign a row number (rn) to each duplicate based on their email. Rows with rn > 1 are the duplicates and get deleted.

Common Pitfalls to Avoid

Accidental Deletion: Always run a SELECT query to identify duplicates before jumping to DELETE. I recommend testing on a small subset of data before running it on the entire table.
Handling More Complex Duplicates: Sometimes duplicates aren’t exact matches. For instance, john.doe@example.com vs. JOHN.DOE@EXAMPLE.COM. Case sensitivity can trip you up, so always normalize data before deduplication.

Final Thoughts: Keep it Clean!

Data quality is key to any successful project. Removing duplicates keeps your database lean and your queries fast. The methods I shared here are good starting points, but always adapt to your specific use case.

Interactive Question:

What strategies do you use to prevent duplicates from entering your database in the first place? Share your best practices below!

Spring Security: Protecting Your App from Everyone (Including You!)

Nikhil Soman Sahu — Mon, 16 Sep 2024 18:00:11 +0000

If you've ever spent an afternoon battling with Spring Security, you might feel like the framework was built for one purpose: to protect your app from everyone, even yourself. In fact, it’s almost as if Spring Security operates on the core philosophy of “Hey, let’s make sure no one can access this, especially the guy who built it.”

So buckle up, as we dive into a sarcastic journey through the world of Spring Security, where permissions are denied, roles are confused, and the developer is the ultimate intruder.

Step 1: The Setup – Inviting Chaos

You start with a basic Spring Boot project, full of hope and optimism. “I’ll just add Spring Security for, you know, security,” you think innocently. A few clicks later, you include the Spring Security dependency. Congratulations, your application is now as secure as Fort Knox—and by that, I mean, no one’s getting in. Not your users, not your admin, and definitely not you.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

You see that? You just installed a force field around your app. Who needs access anyway?

Step 2: Access Denied – The Default Security Config

Spring Security’s default configuration is kind of like a bouncer at a nightclub. He doesn’t care who you are—if you’re not on the list, you’re not getting in. In this case, there is no list, so you’re out by default.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .formLogin().permitAll();
}

The above configuration means your entire app is locked down until authenticated. Even the home page. Yes, the home page! Because why should you have access to your own home, right? Spring Security seems to believe that every route is sacred, and even you, the developer, are not worthy.

Step 3: The Password – Only a Minor Speed Bump

Now that Spring has locked you out of your app, how do you get back in? You open your console and there it is—a randomly generated password printed out just for you. Good luck remembering this 32-character monstrosity:

Using default security password: 9a80989c-78bf-44a5-b96e-8b5d582f7de9

Feeling secure? Because I’m feeling locked out. At this point, it feels like Spring Security is more about security theater than actual functionality. But hey, at least it’s not “admin123.”

Step 4: Configuring User Roles – The Power Struggle

Let's say you want to create an admin role and a user role. Seems simple enough, right? Oh, but this is Spring Security we’re talking about. First, you have to create the roles in the database. Then, you need to grant permissions to your URLs based on these roles. And guess what? Even after you do all that, you'll probably find that no one—not even your admin—can actually access the admin page.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/admin/**").hasRole("ADMIN")
        .antMatchers("/user/**").hasRole("USER")
        .and()
        .formLogin().permitAll();
}

You’ve now implemented role-based access control (RBAC), which is supposed to give you fine-grained control over who can do what. But in reality, you’ve created a hierarchical mess where not even you are sure what your app is doing anymore.

Want to see something fun? Try assigning roles manually in the database and forget to include the “ROLE_” prefix before the role name. Now, nobody has access to anything. Welcome to your own security dungeon.

Step 5: Customizing Authentication – Because Defaults Are Boring

Feeling brave? Want to customize your authentication process? You’ll quickly learn that Spring Security is very protective of its defaults. Change the login page, and you might accidentally break your entire authentication process. Add OAuth2 into the mix, and you’ll spend the next week wondering why your app now authenticates you somewhere, but you’re not quite sure where.

.and()
.formLogin()
.loginPage("/custom-login")
.failureUrl("/login-error");

The above code changes the default login page to a custom one. Seems easy, right? Until you realize that, despite doing everything correctly, your custom login page throws a 403 Forbidden error. Why? Because you, the developer, have no right to be trusted with something as crucial as a login form.

Step 6: Debugging Spring Security – Good Luck with That

One of the best parts about Spring Security is debugging it. When something goes wrong—and trust me, it will—you'll be met with error messages that look like they were generated by a random error generator.

org.springframework.security.access.AccessDeniedException: Access is denied

Access is denied. To what? Why? Who knows! You can stare at your configuration for hours, try every combination of roles and permissions, and the answer is always the same: Access is denied.

At this point, you’re probably questioning your career choices and wondering if securing your app is really worth the effort. Maybe just having no security at all isn’t such a bad idea...

Conclusion: Embrace the Chaos

Spring Security is undoubtedly powerful. It can protect your app from malicious actors, unauthorized users, and, of course, yourself. But be warned: implementing it will test your patience, your sanity, and your will to keep pushing forward.

The next time you encounter an AccessDeniedException, just remember—it’s not personal. Spring Security just wants to protect you from the real danger... you.

Java 8 Features: A Comprehensive Guide

Nikhil Soman Sahu — Mon, 16 Sep 2024 17:11:57 +0000

Java 8, released in March 2014, brought significant improvements and new features to the Java programming language. This version introduced functional programming concepts, enhanced the Java API, and provided developers with powerful tools to write more efficient and concise code. In this article, we'll explore the key features of Java 8 and how they can benefit your development process.

1. Lambda Expressions

Lambda expressions are perhaps the most significant feature introduced in Java 8. They provide a clear and concise way to represent one method interface using an expression. Lambda expressions let you treat functionality as a method argument, or code as data.

Example:

// Before Java 8
Runnable runnable = new Runnable() {
    @Override
    public void run() {
        System.out.println("Hello from thread");
    }
};

// With Lambda in Java 8
Runnable runnable = () -> System.out.println("Hello from thread");

2. Functional Interfaces

Functional interfaces are interfaces that contain only one abstract method. They can have multiple default methods. Java 8 introduced the @FunctionalInterface annotation to mark functional interfaces.

Example:

@FunctionalInterface
interface Converter<F, T> {
    T convert(F from);
}

Converter<String, Integer> converter = (from) -> Integer.valueOf(from);
Integer converted = converter.convert("123");
System.out.println(converted);    // 123

3. Method References

Method references provide easy-to-read lambda expressions for methods that already have a name. They're shorthand for lambdas calling only that specific method.

Example:

Person[] people = ...;
Arrays.sort(people, Person::compareByAge);

4. Stream API

The Stream API is a major addition to Java 8. It allows for functional-style operations on streams of elements. A Stream represents a sequence of elements on which one or more operations can be performed.

Example:

List<String> names = Arrays.asList("Alice", "Bob", "Charlie", "David");
List<String> filteredNames = names.stream()
    .filter(name -> name.startsWith("C"))
    .collect(Collectors.toList());

5. Optional Class

The Optional class is a container object which may or may not contain a non-null value. It's a way of replacing null with a more robust solution.

Example:

Optional<String> optional = Optional.of("hello");
optional.ifPresent(s -> System.out.println(s.length()));

6. Default Methods

Default methods enable new functionality to be added to existing interfaces without breaking older implementations of these interfaces.

Example:

public interface Vehicle {
    default void print() {
        System.out.println("I am a vehicle!");
    }
}

7. New Date and Time API

Java 8 introduced a new date and time API under the package java.time. This new API is more intuitive and addresses the shortcomings of the old java.util.Date and java.util.Calendar.

Example:

LocalDate date = LocalDate.now();
System.out.println("Current date: " + date);

8. Nashorn JavaScript Engine

Java 8 comes with a new JavaScript engine called Nashorn. It's a lightweight high-performance JavaScript runtime that runs on top of the JVM.

Example:

ScriptEngineManager manager = new ScriptEngineManager();
ScriptEngine engine = manager.getEngineByName("nashorn");
engine.eval("print('Hello, Nashorn!');");

9. Base64 Encode Decode

Java 8 now has inbuilt encoder and decoder for Base64 encoding.

Example:

String encodedString = Base64.getEncoder().encodeToString("Hello, World!".getBytes());
System.out.println(encodedString);

Conclusion

Java 8 brought a paradigm shift in Java programming with its functional programming features and API improvements. By leveraging these features, developers can write more readable, maintainable, and efficient code. Whether you're working on a new project or maintaining legacy code, understanding and utilizing Java 8 features can significantly enhance your productivity and the quality of your software.

As Java continues to evolve, mastering these features will prepare you for future advancements in the language and keep your skills sharp in the ever-changing landscape of software development.