Glossary

131 terms from Spring Boot Beyond the Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

@Cacheable: An annotation that stores a method's result in a named cache, keyed by its arguments, so later calls with the same arguments skip the method.
@CacheEvict: An annotation that removes one entry (by key) or every entry (`allEntries = true`) from a cache after the method runs, so readers don't see stale data.
@CachePut: A Spring annotation that always runs the method and stores its new result in the cache. It suits a method that returns the updated object, though evicting the entry with `@CacheEvict` is simpler and harder to get wrong.
@EnableCaching: An annotation, put on `ShopApplication`, that turns on Spring's caching so `@Cacheable` and `@CacheEvict` take effect.
@EnableMethodSecurity: An annotation on `SecurityConfig` that makes Spring honour `@PreAuthorize` checks on service methods.
@EnableResilientMethods: An annotation from Spring Framework 7, put on `ShopApplication`, that turns on `@Retryable` so failing methods are retried.
@EventListener: An annotation that makes Spring call a method whenever an application event of the method's parameter type is published, for example to log failed logins.
@HttpExchange: Annotations that describe a remote HTTP API as a Java interface, such as `RatesApi`. Spring generates the working client behind it.
@Lock: An annotation for repository methods. With `PESSIMISTIC_WRITE`, Hibernate reads the row with `SELECT ... FOR UPDATE`, so a second order waits its turn.
@Modifying: An annotation that tells Spring Data a custom `@Query` changes data, so the method returns the number of rows changed.
@PreAuthorize: An annotation that checks a rule, such as `hasRole('STAFF')`, before a service method runs, so the method refuses callers who lack the role however it is reached.
@Query: An annotation that lets you write the SQL for a repository method yourself. With `nativeQuery = true` the text is plain PostgreSQL, and `:name` placeholders are filled from `@Param` arguments.
@RabbitListener: An annotation that makes Spring call a method for each message arriving on a RabbitMQ queue, converting the JSON body back into an object.
@Retryable: An annotation that makes Spring call a method again after a delay when it throws a listed exception, for example `quote()` retrying on `ResourceAccessException`.
@ServiceConnection: An annotation on a Testcontainers bean that tells Boot to point the datasource at that throwaway container instead of the URL in `application.properties`.
@Transactional: An annotation that runs a whole service method in one transaction: committed when it returns, rolled back if it throws a runtime exception. `readOnly = true` suits methods that only read.
@TransactionalEventListener: An event listener that waits until the publishing transaction commits, and is dropped if it rolls back. `OrderEvents` uses it to send to RabbitMQ only for committed orders.
@Version: An annotation on an entity field that enables optimistic locking: Hibernate adds the version to each update, and a stale save fails.
@WebMvcTest: A test annotation that starts only the web layer. `MockMvc` fakes requests without a real server, and `@MockitoBean` swaps a service for a fake.

A

Actuator: A Spring Boot feature that adds endpoints for health, metrics, loggers and more. In production it is usually moved to a private port, with only a few endpoints exposed.
AMQP: The protocol RabbitMQ speaks. Boot's `spring-boot-starter-amqp` uses it to send and receive messages.
AOT cache: A Java 25 feature that saves class loading and linking work from a training run into a file, so later starts of the same jar are faster.
AOT processing: A Spring build step that works out which beans the app creates and writes hints for reflection, so GraalVM can compile a native image.
Application event: A small object that Spring hands to every method that asked for events of its type. Spring Security announces login results this way, and `OrderPlaced` is published the same way.
Asynchronous: Work that happens after the request is answered, so the sender carries on without waiting. Announcing an order to shipping through a queue is an example.
At-least-once delivery: RabbitMQ's promise that every message arrives, though some may arrive twice. Consumers must therefore be idempotent.
Authentication: Checking who you are, such as a login. A failure here gives a 401.
Authorization: Checking what a known user may do. A failure here, such as a café adding a product, gives a 403.

B

BCrypt: A deliberately slow password hash that mixes in a random salt, so two users with the same password get different hashes.
Bearer token: A token sent in the `Authorization: Bearer ...` header. Whoever holds it is let in, so it must be kept secret.
Buildpacks: A tool that builds a container image from your app without a Dockerfile, choosing a Java runtime and sensible memory options. Run it with `./mvnw spring-boot:build-image`.

C

Cache: A store of recent answers kept in memory so repeated reads skip the database. A hit finds the answer in the cache; a miss doesn't, so the app fetches and keeps a copy.
Cache key: The value an entry is stored under, by default the method's arguments, so each SKU gets its own cached product.
Caffeine: A fast in-memory caching library that Boot uses when it is on the classpath. It adds a maximum size and an expiry time.
Cardinality: The number of distinct values a metric tag can have. Tagging with something like a customer name makes thousands of time series and slows the metrics system.
Checksum: A number computed from a file's text. Flyway compares it at each start, so editing an applied migration, even a comment, stops the app.
Circuit breaker: A resilience pattern that stops calling a service for a while after it keeps failing, so every caller doesn't pay the cost of retries against a service that is down.
Claims: The facts inside a JWT's payload: `sub` (who), `iat` (issued at), `exp` (expires) and extras like `roles`.
Connection pool: A set of open database connections the app reuses instead of opening one per request. Boot uses HikariCP for it.
Consumer: The part of a system that takes messages from a queue and acts on them, such as `ShippingLabels` or `LoyaltyListener`.
Container: A running copy of an image, kept apart from everything else on the machine, that brings its own Java.
Counter: A Micrometer meter that only goes up, such as `shop.orders.placed`, which counts each order placed.
CSRF: Cross-site request forgery: an attack where another website makes your browser send a request, carrying your login cookie, to a site you're logged into. Protection against it can be turned off for an API that uses no cookies, because clients send their credentials with every request and there is nothing to forge.

D

ddl-auto: A Hibernate setting (`spring.jpa.hibernate.ddl-auto`) that controls whether Hibernate creates or changes tables itself. With `validate`, Hibernate only checks that entities match the tables a migration tool such as Flyway created, and stops the app with an error if they don't.
Dead-letter queue: A queue where the broker moves messages that were rejected, such as `orders.failed`, so a person can fix the cause and resend them.
Dirty checking: Hibernate noticing changes to an entity loaded inside a transaction and writing them at commit, with the version check. That is why `replace` needs no `save`.
Docker: The tool that builds images and runs containers. `docker build -t shop-api .` builds an image and `docker run -p 8080:8080` runs it with a port mapped.
Docker Compose: A tool that starts several containers from one `compose.yaml`, such as PostgreSQL and RabbitMQ for development.
Dockerfile: The recipe for an image: `FROM` a Java runtime, `COPY` the jar, run as a non-root `USER` and start it with `ENTRYPOINT`.

E

ECS: A JSON log format that Boot can write with `logging.structured.format.console=ecs`. Boot also knows `logstash` and `gelf`.
Environment variable: A named value the operating system hands a program at start. Production secrets like `DB_PASSWORD` and `JWT_SECRET` come from these.
Eviction: Removing an entry from a cache, either because you asked (`@CacheEvict`) or because Caffeine is full and drops the least used.
Exchange: The part of RabbitMQ that producers send to and that routes each message to a queue. The default exchange delivers to the queue whose name equals the routing key.

F

FACTOR_BEARER: An authority Spring Security 7 adds to record how you logged in: `FACTOR_PASSWORD` for a password, `FACTOR_BEARER` for a token. `/api/token` refuses `FACTOR_BEARER`, so a token can't mint more tokens.
Filter: Code that sees each web request before the controller and can stop it, such as with a 401. Spring Security's filters form the filter chain, set up by a `SecurityFilterChain` bean.
Flyway: A Java tool that applies numbered SQL migration files to the database in order at startup, before Hibernate, and records them.
flyway_schema_history: The table where Flyway records each applied migration with its version, description, checksum and success flag.

G

GraalVM: A JDK that can compile a Java app ahead of time into a native executable. Spring Boot 4.1 needs GraalVM 25 or later.
Graceful shutdown: Boot's default stop behaviour: it stops taking new requests, lets running ones finish, then closes the pool. `timeout-per-shutdown-phase` caps the wait.

H

Hash: A one-way scramble of a password: easy to compute, impossible to reverse. Spring hashes what was typed at login and compares it with the stored hash.
Health indicator: A bean whose `health()` returns up or down for one dependency, such as the carrier gateway, in `/actuator/health`. Keep it cheap and call the remote API directly, without retries.
HikariCP: The connection pool Spring Boot includes. Its default size is 10 connections per instance.
HS256: A JWT signing method using one shared secret of at least 32 bytes. Whoever can check a token can also make one.
HTTP Basic: A scheme where the client sends the username and password with every request in the `Authorization` header. Use it only over HTTPS, since the header isn't encrypted.
HTTP status codes: Three-digit numbers a server sends to say how a request went. Common ones in an API like Kettle & Crane's are 201 Created (something was saved), 400 Bad Request (invalid input), 401 Unauthorized (no or wrong login, so the server doesn't know who you are), 403 Forbidden (known user without the needed role), 404 Not Found (no such item), 409 Conflict (a clash with current data, such as a stale `@Version`, a taken email or too little stock), and 502/503 for a failing or unavailable remote service.

I

Idempotent: Safe to do twice, since the second time changes nothing more. A `GET` can be retried, but `POST /api/orders` can't, and message consumers like `award` must be idempotent.
Identity column: A column PostgreSQL fills with 1, 2, 3... for each new row. Hibernate reads the id back with `GenerationType.IDENTITY`.
Identity provider: A service such as Keycloak, Auth0 or Okta that logs users in and issues signed tokens, so your app only checks them.

J

JDBC driver: The library Java uses to talk to a database. The PostgreSQL driver is needed only at run time, because your code never names it.
JDBC URL: The address of the database for the driver: the driver name, host, port and database, as in `jdbc:postgresql://localhost:5432/shop`.
jwebserver: A small command-line file server that comes with Java and serves a folder over HTTP. It can stand in for a real service, such as a carrier gateway, by serving fixed JSON files.
JWT: A signed token of header, payload (claims) and signature. Anyone can read it, but only the holder of the key can make or change it. The client logs in once and then sends it.

K

Kafka: A message system that keeps every message in a log for days, so new consumers can replay history. Spring uses `@KafkaListener` much like `@RabbitListener`.

L

Lazy loading: Hibernate loads an order's lines only when the code first reads them. If the session is already closed, you get `LazyInitializationException`, so read them inside a transaction.
Liveness probe: A platform's question to an instance: are you still working? If not, it restarts it. Actuator answers at `/actuator/health/liveness`.
Load balancer: A server that spreads requests over instances and handles HTTPS, so the app speaks plain HTTP inside. It passes the caller's details in `X-Forwarded-*` headers.
Loggers endpoint: An Actuator endpoint that reads and changes log levels while the app is running, with no restart. It should be limited to staff, because anyone able to use it could change the app's log levels.
Logs, metrics, traces: The three signals of observability: logs record single events, metrics are numbers over time, and traces follow one request through every service it touches.
Lost update: A race where two orders both read stock 40 and both write 10, so sixty bags are sold but thirty are taken. A transaction alone doesn't prevent it.

M

MDC: A small map of values belonging to the current thread. Boot's JSON logs copy it into each line, which is how `RequestIdFilter` stamps every line with a request id.
Message broker: A server that passes announcements between systems, holding each message in a queue until a consumer takes it. RabbitMQ is the one used here.
Meter: A named measurement held by Micrometer's `MeterRegistry`. A counter only goes up, and a timer reports how often something happens and how long it takes.
Method security: Rules checked on service methods themselves, however they are reached, rather than on URLs. Turned on with `@EnableMethodSecurity`.
Micrometer: The library behind Actuator's metrics. You use its `MeterRegistry` to create your own counters and timers.
Migration: One numbered SQL file, such as `V1__create_tables.sql`, that moves the database one step forward. Never edit one that has been applied; add a new one.

N

Native image: A single executable compiled ahead of time by GraalVM for one operating system. It starts very fast and uses little memory but builds slowly, and it suits short-running apps better than a busy API.

O

ON CONFLICT DO NOTHING: A PostgreSQL insert clause that skips the insert, without an error, if a row with the same key exists. `recordAward` uses it so each order awards points only once.
Open-in-view: A Boot default that keeps a database session open for the whole web request. Production apps turn it off, so lazy data must be read inside a transaction.
OpenTelemetry: A standard for tracing. Boot's OpenTelemetry starter records spans for incoming requests and `RestClient` calls and sends them to a collector over OTLP.
Optimistic locking: Assume conflicts are rare and check a version number on save. If someone else saved first, the save fails and the client can retry.
Outbox pattern: A fix for lost messages: save the message in a database table in the same transaction, and send it from there later.

P

Pessimistic locking: Lock the row as you read it so a second order waits. Use it when conflicts are common or a retry is costly.
Placeholder: A `${NAME}` in a properties file that Spring replaces at start with the environment variable of that name. The app stops if it is missing.
Platform thread: A normal Java thread backed by an operating-system thread. It is expensive, so a server keeps only a few hundred.
Practice profile: A Spring profile that adds two sample accounts, Sam and Bloom Café, for learning and testing. It must never be switched on in production, because those accounts have a known, published password.
ProblemDetail: Spring's standard JSON error body, holding a status, title and detail. `ApiErrors` returns one to turn an exception into a clear 409.
Producer: The app that sends a message, such as the order API announcing that an order was placed.
Prometheus: An open-source system that stores metrics over time by fetching them from each app's `/actuator/prometheus` every few seconds.
Propagation: What a transactional method does when called inside another transaction. `REQUIRED` (default) joins it; `REQUIRES_NEW` pauses it and commits on its own, for something like an audit row that must survive a rollback.
Proxy: A generated object Spring hands to other beans in place of yours. It adds behaviour such as transactions, caching and retries around your method, and calls from inside the same class skip it.

Q

Queue: A waiting line in the broker that holds each message until a consumer takes it, such as `orders.placed`. A durable queue survives a broker restart.

R

RabbitMQ: A popular open-source message broker, version 4 here, listening on port 5672 with a management page on 15672.
Readiness probe: A platform's question: can you take traffic now? If not, requests go elsewhere. It lists only what the app can't work without, so a down gateway doesn't take every instance out.
Redis: An in-memory data store that all app instances can share, so the same cache annotations work across copies of the API.
Relaxed binding: Boot's rule that an environment variable like `SPRING_DATASOURCE_URL` sets the property `spring.datasource.url`.
Repeatable migration: A migration with no version, named `R__...`, that Flyway re-runs whenever its checksum changes, after the versioned ones. It suits objects you replace, such as the `low_stock` view.
Request id: A short random id that `RequestIdFilter` puts in the MDC and in an `X-Request-Id` response header, so every log line of one request can be found together.
Resource server: The part of Spring Security that checks incoming tokens: the signature and expiry, then turns the claims into a login.
RestClient: Spring's client for calling HTTP services: `get()`, `uri()`, `retrieve()` and `body()` turn a JSON answer into a record. Boot's builder adds timeouts.
Role: An authority (a named permission) whose name starts with `ROLE_`, such as `ROLE_STAFF`. `hasRole("STAFF")` checks for exactly that.
Rollback-only: The state a shared transaction enters when a joined step fails: it can only roll back. Swallowing the exception doesn't save it, and Spring throws `UnexpectedRollbackException`.
Routing key: The label a message is sent with. The exchange uses it to pick the queue; with the default exchange the key equals the queue name.
RS256: A JWT signing method using a private key to sign and a public key to check, so many apps can check tokens only one server can make. Identity providers use it.
Runtime exception: An unchecked exception. Spring rolls a transaction back for these by default, but commits for checked exceptions unless you set `rollbackFor`.

S

Salt: Random data mixed into each hash, so two users with the same password get different hashes and precomputed hash lists are useless.
Scrape: Prometheus fetching the current metrics from an app's endpoint, repeated every few seconds.
Self-invocation: A method calling another method in its own class. The call skips the proxy, so `@Transactional`, `@Cacheable` and `@Retryable` do nothing.
Span: One step of a traced request. A trace is the tree of spans for one request, tied together by a trace ID that services pass along in an HTTP header.
Spring profile: A named set of settings, such as `prod`, read on top of `application.properties` when the app starts with `--spring.profiles.active=prod`.
Stale data: A cached answer that no longer matches the database, such as old stock after Sam takes two bags. Evictions and a TTL guard against it.
Stateless session: A setting telling Spring Security never to create a server-side session, since every request proves itself with its credentials or token.
Structured logs: Log lines written as one JSON object each, so a log tool can search fields such as level or logger.

T

Tag: A name and value pair that splits a meter, such as `uri` or `status` on `http.server.requests`. Keep tags to few possible values.
Testcontainers: A library that starts a throwaway PostgreSQL in a Docker container for a test run and deletes it afterwards, so tests use the same kind of database as production.
Timeout: A limit on waiting for another service: the connect timeout for the connection, the read timeout for the answer. Running out throws `ResourceAccessException`.
Transaction: A group of database changes that succeed or fail together: commit saves them all, rollback undoes them all.
TTL: How long a cache entry may live, such as `expireAfterWrite=10m`. It is the safety net if you forget an eviction.

U

UserDetailsService: A Spring Security interface with one method that takes a username and returns the matching user. It can load accounts from a table, and an unknown username throws `UsernameNotFoundException`, which results in a 401.

V

View: A saved query that looks like a table, such as `low_stock`. A repeatable migration can replace it safely.
Virtual thread: A cheap thread the JVM manages itself (Java 21+). When a request waits for PostgreSQL, the JVM sets it aside, though the database pool size is still the limit.

X

X-Forwarded headers: Headers a load balancer adds with the caller's address and scheme. `forward-headers-strategy=framework` makes Spring trust them, so use it only behind a proxy you control.