springboot-patterns

Use a Controller layer for endpoints and DTO validation, a Service layer with @Transactional for business logic, and a Spring Data JPA Repository for data access. Keep controllers thin and never expose entities directly; map them to response DTOs.

Use @ControllerAdvice with an @ExceptionHandler for MethodArgumentNotValidException to return a 400 response with field-level error messages. Enable spring.mvc.problemdetails.enabled=true in Spring Boot 3 for RFC 7807 error responses.

Enable caching with @EnableCaching on a configuration class, then annotate service methods with @Cacheable for reads and @CacheEvict for invalidation. Specify cache names and keys, for example @Cacheable(value = "market", key = "#id").

No, X-Forwarded-For is spoofable unless your app sits behind a trusted proxy. Configure server.forward-headers-strategy and register ForwardedHeaderFilter so request.getRemoteAddr() returns the real client IP, and ensure the proxy overwrites the header.

Extend OncePerRequestFilter and use Bucket4j to keep a token bucket per client IP in a ConcurrentHashMap. Consume one token per request and return HTTP 429 when the bucket is empty.

Prefer constructor injection for all production code because it makes dependencies explicit, supports final fields, and simplifies unit testing. Field injection with @Autowired hides dependencies and complicates testing.