DEV Community: Rajesh Mishra

Spring AI vs LangChain4j comparison which to use 2026 — Complete Guide 2026

Rajesh Mishra — Sat, 31 Oct 2026 13:59:25 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

Introduction Artificial‑intelligence integration has become a core part of modern Java applications. In 2026 the two most talked‑about ecosystems for building LLM‑driven services are Spring AI and LangChain4j . Both projects aim to simplify prompt engineering, model orchestration, and tool integration, yet they differ in philosophy, ecosystem fit, and runtime characteristics. This post provides a quick‑look overview to help you decide which stack aligns with your project goals. Aspect Spring AI (2026) LangChain4j (2026) Primary Audience Spring‑centric developers, enterprise teams, microservice architects LLM‑first developers, polyglot teams, rapid‑prototype enthusiasts Core Integration Model Spring Bean lifecycle, @Configuration , ApplicationContext Fluent builder pattern, functional pipel

📖 Read the Full Tutorial

🔗 Spring AI vs LangChain4j comparison which to use 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

LangChain4j Tutorial: Building AI Apps in Java – Complete Guide 2026

Rajesh Mishra — Thu, 29 Oct 2026 14:45:24 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

TL;DR LangChain4j is the 2026‑ready Java library that lets you stitch together LLMs, vector stores, agents, and tool‑calling pipelines with just a few lines of code. Below is a rapid‑fire overview of what the framework provides, the essential steps to spin up a Java AI app, and the key takeaways from this guide. Feature What It Does Typical Use‑Case LLM Wrapper Unified API for OpenAI, Anthropic, Gemini, Ollama, etc. Chatbots, text generation, summarisation. Prompt Templates Typed, reusable templates with Jinja‑style variables. Dynamic queries, few‑shot prompting. Memory & Chains Conversation buffers, retrieval‑augmented generation (RAG) pipelines. Customer support agents, knowledge‑base assistants. Vector Store Connectors Plug‑and‑play adapters for Pinecone, Qdrant, Milvus, Chroma. Semanti

📖 Read the Full Tutorial

🔗 LangChain4j tutorial building AI apps in Java complete guide 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

Spring AI Complete Tutorial: Getting Started Guide 2026

Rajesh Mishra — Tue, 27 Oct 2026 13:44:39 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

TL;DR Spring AI is the Spring ecosystem’s unified abstraction layer for generative AI services (LLMs, embeddings, vector stores, chat‑agents, etc.). In 2026 it matters because: It hides vendor‑specific APIs (OpenAI, Anthropic, Azure, AWS Bedrock, etc.) behind a single, type‑safe Spring interface. It integrates natively with Spring Boot, Spring Cloud, and the new spring-boot-starter-ai starter, enabling rapid prototyping and production‑grade observability. It supports the emerging AI‑first architecture patterns: RAG pipelines, tool‑calling agents, and multimodal workflows. The tutorial walks you through building a complete end‑to‑end Spring Boot application that: Configures an LLM (e.g., OpenAI GPT‑4o) via Spring properties. Creates an EmbeddingModel and stores vectors in a PostgreSQL‑PGVec

📖 Read the Full Tutorial

🔗 Spring AI complete tutorial getting started guide 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

Hybrid Search in 2026: Combining Keyword and Semantic Search – A Complete Tutorial

Rajesh Mishra — Sun, 25 Oct 2026 12:51:21 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

TL;DR Hybrid search merges BM25 keyword matching with vector similarity from modern LLM embeddings. The result is a relevance boost, better handling of synonyms and intent, while retaining the speed and interpretability of classic inverted indexes. Follow the three‑step workflow below to implement → test → deploy a production‑ready hybrid search pipeline. Component Keyword (BM25) Semantic (Vector) Hybrid Strength Exact term matching, fast posting‑list look‑ups Synonym/intent capture, robust to typo Best‑of‑both worlds – higher NDCG, lower latency than pure vector Typical Score BM25 score (float) Cosine similarity (float) Weighted sum: α·BM25 + (1‑α)·cosine Index Size ~30 GB for 10 M docs ~120 GB (768‑dim float16) Both stored side‑by‑side; compression tricks keep total Implementation sketch

📖 Read the Full Tutorial

🔗 Hybrid search combining keyword and semantic search tutorial 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

Spring Security role based access control RBAC tutorial — Complete Guide

Rajesh Mishra — Sun, 25 Oct 2026 12:20:08 +0000

Spring Security role based access control RBAC tutorial — Complete Guide

A practical, in-depth guide to Spring Security role based access control RBAC tutorial with examples.

INTRO

Most Spring Boot applications ship with a default security configuration that either leaves every endpoint open or locks everything behind a generic login. In real‑world services, you rarely have a single “admin” role that can do everything; you need fine‑grained permissions that map to business concepts like MANAGER, CUSTOMER_SUPPORT, or API_CONSUMER. Without a clear RBAC strategy, you end up scattering if checks throughout controllers, duplicating logic, and exposing sensitive data when a role is added or changed.

Spring Security gives you the building blocks—GrantedAuthority, @PreAuthorize, and the HttpSecurity DSL—but stitching them together into a maintainable RBAC layer is non‑trivial. You have to decide where roles live (in the database, LDAP, or JWT claims), how they are loaded into the security context, and how to enforce them consistently across REST endpoints and method calls. The guide linked below walks through every decision point, shows you how to avoid common pitfalls, and ends with a production‑ready configuration you can drop into any Spring Boot project.

WHAT YOU'LL LEARN

How to model roles and permissions in a relational database and map them to Spring Security’s GrantedAuthority.
Configuring UserDetailsService to load a user’s authorities efficiently with JPA/Hibernate.
Securing REST endpoints with both URL‑based rules (http.authorizeRequests()) and method‑level annotations (@PreAuthorize).
Dynamically updating a user’s roles at runtime without restarting the application.
Testing RBAC policies using Spring’s @WithMockUser and MockMvc.
Pitfalls to watch out for: role hierarchy, authority duplication, and caching stale permissions.

A SHORT CODE SNIPPET

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private CustomUserDetailsService userDetailsService;

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService)
.passwordEncoder(new BCryptPasswordEncoder());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/api/public/**").permitAll()
.antMatchers(HttpMethod.GET, "/api/orders/**").hasAnyRole("USER", "ADMIN")
.antMatchers(HttpMethod.POST, "/api/orders/**").hasRole("ADMIN")
.anyRequest().authenticated()
.and()
.httpBasic();
}
}

The snippet shows a concise, production‑oriented security filter chain: public endpoints are open, read‑only order APIs accept both USER and ADMIN, while creation requires ADMIN. The heavy lifting—loading roles from the database—is delegated to CustomUserDetailsService.

KEY TAKEAWAYS

Define roles and permissions as first‑class entities; never hard‑code strings throughout your codebase.
Leverage both URL‑level and method‑level security to keep the access matrix readable and testable.
Keep the authority cache in sync with the data store; a simple @CacheEvict on role updates prevents stale permissions.
Comprehensive unit and integration tests are essential; they catch mis‑configured antMatchers before they hit production.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:

Spring Security role based access control RBAC tutorial — Complete Guide

Spring Security API key authentication for REST APIs tutorial — Complete Guide

Rajesh Mishra — Sat, 24 Oct 2026 11:51:07 +0000

Spring Security API key authentication for REST APIs tutorial — Complete Guide

A practical, in-depth guide to Spring Security API key authentication for REST APIs tutorial with examples.

INTRO

Every day we ship micro‑services that expose JSON endpoints to internal tools, mobile apps, or third‑party partners. The default Spring Security setup assumes a session‑based, form‑login flow—perfect for web UIs but a poor fit for stateless APIs. When you try to protect a REST endpoint with the out‑of‑the‑box configuration, you quickly hit a wall: CSRF tokens, redirects, and HttpSession objects start leaking into your API contract, forcing clients to handle cookies they never asked for.

The pragmatic solution is to replace the heavyweight OAuth dance or JWT boilerplate with a simple API key. An API key is just a secret string that a client includes in each request, typically via a header. It’s easy to generate, rotate, and audit, and it works flawlessly with Spring’s filter chain. The challenge isn’t the concept—it’s wiring the key check into Spring Security without breaking the rest of your configuration, handling missing or malformed keys gracefully, and keeping the implementation testable.

If you’ve ever written a custom OncePerRequestFilter that felt like a hack, or you’ve been forced to expose your endpoints without any protection because “security is too hard,” this guide will show you a clean, production‑ready way to integrate API key authentication directly into Spring Security’s authentication manager.

WHAT YOU'LL LEARN

How to define a lightweight AuthenticationToken that represents an API key and plug it into Spring’s AuthenticationProvider.
Configuring the security filter chain to intercept requests, extract the key from a custom header, and delegate to the provider.
Storing API keys securely using Spring Data JPA, with hashing and rotation strategies.
Writing unit and integration tests for the filter, provider, and controller layers without starting a full server.
Common pitfalls such as leaking keys in logs, handling multiple keys per client, and mixing API key auth with other mechanisms.
Production hardening tips: rate limiting, revocation, and monitoring key usage with Spring Actuator.

A SHORT CODE SNIPPET

// 1. Simple Authentication token that holds the raw API key
public class ApiKeyAuthenticationToken extends AbstractAuthenticationToken {
private final String apiKey;
private final UserDetails principal;

public ApiKeyAuthenticationToken(String apiKey) {
super(null);
this.apiKey = apiKey;
this.principal = null;
setAuthenticated(false);
}

public ApiKeyAuthenticationToken(UserDetails principal, String apiKey,
Collection<? extends GrantedAuthority> authorities) {
super(authorities);
this.apiKey = apiKey;
this.principal = principal;
setAuthenticated(true);
}

@Override
public Object getCredentials() {
return apiKey;
}

@Override
public Object getPrincipal() {
return principal;
}
}

This token is the cornerstone of the authentication flow. The filter extracts the header, creates an unauthenticated instance, and hands it to the provider. If the key matches a stored record, the provider returns an authenticated token populated with the user’s authorities.

KEY TAKEAWAYS

Leverage Spring’s extensibility: By creating a custom AuthenticationToken and AuthenticationProvider, you keep the API key logic out of controllers and let Spring handle the heavy lifting.
Never store raw keys: Hash the API key (e.g., BCrypt) before persisting, and compare hashes during authentication to mitigate leakage.
Fail fast and stay silent: Return 401 Unauthorized without revealing whether the key was missing or invalid; this prevents enumeration attacks.
Make it testable: Isolate the filter, provider, and repository so you can unit‑test each piece with mock requests and verify behavior under edge cases.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:
Spring Security API key authentication for REST APIs tutorial — Complete Guide

How to Chunk Documents for RAG: Optimal Chunking Strategies 2026

Rajesh Mishra — Fri, 23 Oct 2026 12:57:33 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

TL;DR – Optimal Document Chunking for RAG in 2026 Why chunking matters : RAG models retrieve and generate based on context windows. Proper chunking maximizes relevance, reduces hallucinations, and fits within token limits of modern LLMs (8‑32 k tokens in 2026). Goal Metric Impact Typical Token Range (2026) Retrieval precision ↑ Recall & ↓ Noise 200‑800 tokens Generation fidelity ↑ Coherence & ↓ Hallucination 400‑1200 tokens Cost efficiency ↓ API tokens × price Variable (depends on model) Top chunking strategies for 2026 (choose one or combine): Semantic Sliding Window – overlap = 15 % of chunk size; uses embeddings to keep topic continuity. Adaptive Token Budgeting – dynamically size chunks based on per‑section token density (e.g., tables vs. prose). Structure‑Aware Chunking – respects hea

📖 Read the Full Tutorial

🔗 How to chunk documents for RAG optimal chunking strategies 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

Spring Security method level security PreAuthorize Secured — Complete Guide

Rajesh Mishra — Thu, 22 Oct 2026 12:46:13 +0000

Spring Security method level security PreAuthorize Secured — Complete Guide

A practical, in-depth guide to Spring Security method level security PreAuthorize Secured with examples.

INTRO

Every production‑grade Spring Boot service eventually hits the point where you need to protect who can call what. Relying solely on URL‑based filters leaves a dangerous blind spot: a malicious client can bypass the front‑door by invoking a service bean directly, or a teammate can accidentally expose a critical operation through a new endpoint. The result? Sensitive data leaks, unauthorized state changes, and a nightmare when you try to audit who did what.

Method‑level security closes that gap by moving the access decision right to the business logic. With annotations like @PreAuthorize and @Secured, you declare intent next to the code that matters, and Spring’s expression language lets you compose complex rules without scattering if‑else checks throughout the codebase. The trade‑off is a bit of configuration and a learning curve around SpEL, but the payoff is a clean, declarative security model that scales with your domain.

If you’ve ever wrestled with “who can delete a user?” or “why does my admin endpoint still reject a manager token?”, this guide will give you a concrete, end‑to‑end recipe for getting method security right the first time.

WHAT YOU'LL LEARN

The difference between @PreAuthorize and @Secured – when to pick one over the other and how they interact with Spring’s MethodSecurityExpressionHandler.
Setting up global method security – the minimal @EnableGlobalMethodSecurity flags you need, and how to avoid the common pitfall of forgetting to enable proxy‑based security.
Writing expressive SpEL expressions – from simple role checks (hasRole('ADMIN')) to dynamic permission lookups (@permissionService.hasAccess(#id, authentication)).
Integrating custom permission evaluators – plug in your own PermissionEvaluator or MethodSecurityExpressionRoot to enforce domain‑specific rules without polluting controllers.
Testing method security – unit‑test strategies with @WithMockUser, @WithSecurityContext, and the Spring Test Security module to guarantee your annotations behave as expected.
Production hardening tips – caching decisions, handling AccessDeniedException globally, and avoiding proxy‑target class pitfalls in AOP‑heavy applications.

A SHORT CODE SNIPPET

@Service
public class DocumentService {

// Only users with ROLE_EDITOR or the owner of the document can update it
@PreAuthorize("hasRole('EDITOR') or @docPermission.checkOwner(#docId, authentication)")
public Document updateDocument(Long docId, DocumentDto dto) {
Document doc = repository.findById(docId)
.orElseThrow(() -> new NotFoundException());
// business logic …
return repository.save(doc);
}
}

In this tiny fragment the security rule lives right next to the method signature. The custom bean docPermission encapsulates the “owner” check, keeping the expression readable while still leveraging full Spring DI.

KEY TAKEAWAYS

Method‑level annotations give you defense in depth by protecting the service layer, not just the web layer.
@PreAuthorize offers full SpEL power; @Secured is a lightweight alternative for simple role checks.
A custom PermissionEvaluator or expression root lets you express domain concepts (ownership, hierarchy, time‑based access) without leaking them into controllers.
Proper testing and proxy configuration are essential; a mis‑configured @EnableGlobalMethodSecurity silently disables all your annotations.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:

Spring Security method level security PreAuthorize Secured — Complete Guide

Semantic Search with Java Spring Boot Embeddings: A 2026 Tutorial

Rajesh Mishra — Wed, 21 Oct 2026 13:19:30 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

TL;DR This snapshot walks you through building a semantic‑search API with Spring Boot (2026). You’ll: Bootstrap a spring-boot-starter-web project. Call the 2026 LLM embeddings endpoint (e.g., https://api.llm2026.com/v1/embeddings ) to turn text into dense vectors. Persist those vectors in a vector‑DB (e.g., Qdrant or Milvus ). Expose a /search REST endpoint that receives a query, generates its embedding, runs a k‑NN lookup, and returns the most semantically similar documents. Step Tool / Library Key Code Snippet 1⃣ Project Setup Spring Initializr (Web, Lombok, Validation) org.springframework.boot spring-boot-starter-web 2⃣ Embedding Service WebClient (reactive HTTP client) @Service public class EmbeddingService { privat

📖 Read the Full Tutorial

🔗 Semantic search with Java Spring Boot embeddings tutorial 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

Spring Security session management and remember me tutorial — Complete Guide

Rajesh Mishra — Tue, 20 Oct 2026 12:31:50 +0000

Spring Security session management and remember me tutorial — Complete Guide

A practical, in-depth guide to Spring Security session management and remember me tutorial with examples.

INTRO

Every production‑grade Spring Boot app eventually hits the “session” wall. You might have started with a simple form login, but as traffic grows you’ll notice users getting logged out unexpectedly, concurrent logins being abused, or, worse, session fixation attacks slipping through the cracks. The default Spring Security configuration protects you against the most obvious threats, yet it leaves critical knobs untouched: session concurrency limits, custom session expiration policies, and the infamous “remember‑me” cookie that can become a backdoor if mis‑configured.

Ignoring these knobs isn’t just a theoretical risk. Real‑world incidents—like users being forced off a shared workstation because another device silently hijacked their session—are often traced back to lax session management. Meanwhile, developers love the convenience of “keep me logged in” but end up storing plain tokens or using the default 2‑week cookie without any persistence strategy, opening the door to replay attacks. The right balance between security and usability requires a deliberate, code‑first approach, and that’s exactly what the full guide walks you through.

In this teaser, I’ll highlight why you should care about session fixation, concurrency control, and a robust remember‑me implementation before you ship your next microservice or monolith. The goal isn’t to replace Spring Security’s defaults but to extend them with production‑ready patterns that keep users safe without sacrificing the smooth “stay signed in” experience they expect.

WHAT YOU'LL LEARN

How to enforce session fixation protection and rotate session IDs after authentication.
Configuring concurrent session control: limiting logins per user and handling session expiration events.
Implementing a custom SessionRegistry to track active sessions across a distributed cluster.
Setting up a persistent “remember‑me” token store (JDBC, Redis, or JPA) instead of the insecure default.
Securing the remember‑me cookie with HttpOnly, Secure, and same‑site attributes.
Common pitfalls—such as mixing stateless JWT filters with stateful session management—and how to avoid them.

A SHORT CODE SNIPPET

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private DataSource dataSource; // for persistent token repository

@Override
protected void configure(HttpSecurity http) throws Exception {
http
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.sessionManagement()
.sessionFixation().migrateSession() // rotate ID on login
.maximumSessions(1) // one session per user
.maxSessionsPreventsLogin(false) // allow new login, expire old
.sessionRegistry(sessionRegistry())
.and()
.and()
.rememberMe()
.key("mySuperSecretKey")
.tokenValiditySeconds(1209600) // 14 days
.tokenRepository(persistentTokenRepository());
}

@Bean
public SessionRegistry sessionRegistry() {
return new SessionRegistryImpl();
}

@Bean
public PersistentTokenRepository persistentTokenRepository() {
JdbcTokenRepositoryImpl repo = new JdbcTokenRepositoryImpl();
repo.setDataSource(dataSource);
return repo;
}
}

This snippet shows the essential pieces: session fixation protection, a single‑session policy, and a JDBC‑backed remember‑me token store—all configurable in a few fluent calls.

KEY TAKEAWAYS

Never trust the default session cookie – always enable session fixation protection and consider rotating IDs on every successful authentication.
Concurrent session control is a first‑line defense against credential sharing and session hijacking; a custom SessionRegistry lets you monitor and revoke sessions centrally.
Persisted remember‑me tokens are far safer than the in‑memory default; they let you invalidate tokens on password change or logout.
Cookie attributes matter – HttpOnly, Secure, and SameSite=Strict/Lax dramatically reduce the attack surface for XSS and CSRF exploits.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:

Spring Security session management and remember me tutorial — Complete Guide

Chroma DB Tutorial 2026: Building a Local Vector Database for AI Apps

Rajesh Mishra — Mon, 19 Oct 2026 15:07:57 +0000

This is a summary of the full tutorial published on howtostartprogramming.in.

TL;DR A lightning‑fast guide to getting Chroma DB up and running locally for AI apps in 2026. Install, spin up a collection, index your embeddings, and query vectors—all in a few commands. Step Command / Code What it does 1⃣ Install pip install chromadb Pulls the latest Chroma DB package (v0.5+ as of 2026) with all native dependencies. 2⃣ Initialise client import chromadb client = chromadb.PersistentClient(path="./chroma_data") Creates a local SQLite‑backed store at ./chroma_data . 3⃣ Create collection collection = client.get_or_create_collection( name="my_docs", metadata={"description": "Vector store for knowledge‑base docs"} ) Sets up a namespace (collection) where vectors and metadata live. 4⃣ Index embeddings ids = [f"doc_{i}" for i in range(len(texts))] embeddings = model.encode(texts

📖 Read the Full Tutorial

🔗 Chroma DB tutorial local vector database for AI apps 2026 — Full Guide with Code Examples

The full article includes:

✅ Step-by-step code examples (copy-paste ready)
✅ Complete working project (Spring Boot / Java)
✅ Common mistakes + fixes
✅ Production tips and benchmarks
✅ FAQ section

Published on How to Start Programming — practical AI and Java tutorials for developers.

Spring Security custom UserDetailsService with database example — Complete Guide

Rajesh Mishra — Mon, 19 Oct 2026 14:19:17 +0000

Spring Security custom UserDetailsService with database example — Complete Guide

A practical, in-depth guide to Spring Security custom UserDetailsService with database example with examples.

INTRO

When you start wiring Spring Security into a real‑world application, the default in‑memory user store quickly becomes a dead end. Hard‑coding usernames, passwords, and roles works for demos, but it collapses under the weight of multi‑tenant data, password‑policy changes, and audit requirements. The moment you need to pull credentials from a relational database, you’re forced to confront a gap in the official docs: how to bridge Spring Security’s UserDetailsService contract with JPA/Hibernate without reinventing the wheel.

That gap isn’t just academic. In production, a mis‑configured UserDetailsService can expose plaintext passwords, bypass role hierarchies, or cause subtle bugs that only appear under load. A clean, testable implementation that respects Spring’s transaction boundaries and leverages the power of Spring Data is essential for any serious backend. This article teases the exact steps you need to get a robust, database‑backed authentication layer up and running.

WHAT YOU'LL LEARN

How to model User and Role entities that satisfy Spring Security’s UserDetails contract.
Building a custom UserDetailsService that fetches users via Spring Data JPA, with proper exception handling.
Configuring PasswordEncoder and wiring the service into the security filter chain without XML.
Writing unit tests for the service using @DataJpaTest and Mockito to guarantee correctness.
Common pitfalls (lazy loading, circular dependencies, and password migration) and how to avoid them.
Production‑ready tips: caching user details, handling account lockout, and integrating with JWT or session‑based auth.

A SHORT CODE SNIPPET

@Service
public class CustomUserDetailsService implements UserDetailsService {

private final UserRepository userRepo;
private final PasswordEncoder passwordEncoder;

public CustomUserDetailsService(UserRepository userRepo,
PasswordEncoder passwordEncoder) {
this.userRepo = userRepo;
this.passwordEncoder = passwordEncoder;
}

@Override
@Transactional(readOnly = true)
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepo.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("User not found"));
return new org.springframework.security.core.userdetails.User(
user.getUsername(),
user.getPassword(),
user.isEnabled(),
true,
true,
!user.isLocked(),
mapRolesToAuthorities(user.getRoles()));
}

private Collection<? extends GrantedAuthority> mapRolesToAuthorities(Set<Role> roles) {
return roles.stream()
.map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
.collect(Collectors.toSet());
}
}

KEY TAKEAWAYS

A custom UserDetailsService is the bridge between Spring Security and any persistent store; keep it thin and delegate data access to Spring Data repositories.
Always annotate loadUserByUsername with @Transactional(readOnly = true) to avoid lazy‑loading exceptions during authentication.
Encode passwords with a strong PasswordEncoder (e.g., BCryptPasswordEncoder) and never store raw credentials.
Test the service in isolation and as part of the security configuration to catch integration bugs early.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:

Spring Security custom UserDetailsService with database example — Complete Guide