springboot-patterns

Structure Spring Boot APIs with thin @RestController classes delegating to @Service classes containing business logic, which call Spring Data JPA repositories. Use constructor injection, DTO records for requests and responses, and keep controllers free of business logic.

Use @ControllerAdvice with @ExceptionHandler for MethodArgumentNotValidException to catch bean validation failures across all controllers. Extract field errors from the BindingResult and return a consistent error response with HTTP 400 status.

Yes, caching requires @EnableCaching on a configuration class before @Cacheable and @CacheEvict annotations work. By default Spring uses a concurrent map cache, but you can plug in Redis or Caffeine as the cache provider.

The X-Forwarded-For header is client-supplied and trivially spoofable, so attackers can bypass IP-based rate limits. Only trust it behind a configured reverse proxy with server.forward-headers-strategy set and ForwardedHeaderFilter registered; otherwise use request.getRemoteAddr().

Use @Transactional(readOnly = true) on query methods that only fetch data without modifications. This lets Hibernate skip dirty-checking and flush operations, reducing memory usage and improving query performance.