Spring/Spring Boot Internals Deep‑Dive Roadmap (Web Backend)

---

1) Boot vs Framework Internals

• Startup phases: SpringApplication prepares Environment, creates and refreshes ApplicationContext, then runs CommandLineRunner/ApplicationRunner.
• Context refresh steps: load bean definitions, register post‑processors, instantiate singletons, run lifecycle callbacks.
• Auto‑configuration: @AutoConfiguration classes imported via META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports (Boot 3+). Conditions (@ConditionalOnClass, @ConditionalOnMissingBean, profiles, properties) drive inclusion.
• Condition report: Actuator conditions endpoint to inspect matched/unmatched auto‑configs.
• Links: Spring Boot Reference — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/

2) Core Container Internals

• DI/IoC: BeanDefinition metadata, constructor injection preferred; scopes: singleton, prototype, request, session.
• Lifecycle: @PostConstruct, InitializingBean#afterPropertiesSet, DisposableBean#destroy, initMethod/destroyMethod.
• Extension points: BeanFactoryPostProcessor (mutate definitions pre-instantiation); BeanPostProcessor (wrap/adjust instances e.g., proxies).
• AOP & proxying: JDK dynamic proxies for interfaces, CGLIB for classes. Advisors (advice + pointcut) ordered via @Order/Ordered/PriorityOrdered.
• Links: Spring Framework Core — https://docs.spring.io/spring-framework/reference/core/

3) Transactions

• Proxy model: @Transactional creates proxies; only external calls cross transactional boundaries. Self‑invocation/private/final methods won’t be intercepted.
• Settings: propagation (REQUIRED, REQUIRES_NEW, NESTED), isolation (READ_COMMITTED, etc.), timeouts, rollback rules.
• Managers: PlatformTransactionManager; JPA uses JpaTransactionManager. EntityManager lifecycle per transaction; beware Open‑Entity‑Manager‑in‑View.
• Links: Transactions — https://docs.spring.io/spring-framework/reference/data-access/transaction/

4) Web MVC Pipeline

• Request flow: DispatcherServlet → HandlerMapping → HandlerAdapter → controller → HandlerMethodArgumentResolver → ReturnValueHandler → HttpMessageConverter (Jackson) → response.
• Validation: Jakarta Bean Validation via @Valid/BindingResult.
• Global advice: @ControllerAdvice for exception handling and @InitBinder.
• Servlet vs Spring levels: Filter/OncePerRequestFilter (servlet) vs HandlerInterceptor (Spring MVC).
• Links: Spring Web MVC — https://docs.spring.io/spring-framework/reference/web/webmvc/

5) Spring Security Internals

• Filter chain: define SecurityFilterChain with HttpSecurity; order of filters matters.
• Authentication: AuthenticationManager delegates to AuthenticationProviders (DAO, JWT, OAuth2).
• SecurityContext: stored in SecurityContextHolder (ThreadLocal); propagate across async/executors.
• CSRF/CORS: for stateless APIs typically disable CSRF; configure CORS correctly.
• JWT Resource Server: spring-boot-starter-oauth2-resource-server with oauth2ResourceServer().jwt().
• Links: Spring Security — https://docs.spring.io/spring-security/reference/

6) Configuration & Properties

• Environment abstraction: Environment, PropertySources (system, YAML/properties, command‑line).
• Profiles: activation, spring.profiles.group, profile‑specific files.
• Type‑safe binding: @ConfigurationProperties via Binder, relaxed binding, validation; conversion via ApplicationConversionService.
• Links: Externalized Config — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#features.external-config

7) Observability

• Actuator: endpoints health, metrics, info, beans, mappings, conditions.
• Micrometer: Boot auto‑configures MeterRegistry; add custom meters, common tags.
• Tracing: Micrometer Observation/Tracing integrates with OpenTelemetry; correlate logs with trace IDs.
• Links: Actuator — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#actuator
• Links: Micrometer — https://micrometer.io/
• Links: OpenTelemetry Java — https://opentelemetry.io/docs/languages/java/

8) Data & Performance

• Spring Data JPA: repository infrastructure, query derivation, @Query, specifications.
• Fetch strategies: @EntityGraph, LAZY/EAGER tuning, fetch joins; diagnose N+1 via SQL logs.
• Connection pooling: HikariCP defaults; tune maximumPoolSize, connectionTimeout, monitor via metrics.
• Caching: Spring Cache abstraction (@EnableCaching, @Cacheable, @CacheEvict) backed by Caffeine/Redis.
• Links: Spring Data JPA — https://docs.spring.io/spring-data/jpa/docs/current/reference/html/
• Links: DataSource & Pooling — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#features.sql.datasource

9) Testing Internals

• Test slices: @WebMvcTest, @DataJpaTest to load partial contexts; faster than @SpringBootTest.
• Context caching: Spring Test caches contexts; avoid @DirtiesContext unless needed.
• Execution: TestExecutionListeners; transactional tests roll back by default.
• Testcontainers: real DB behavior; Boot service connections simplify wiring.
• Links: Boot Testing — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#features.testing
• Links: Testcontainers — https://testcontainers.com/

10) Hands‑On Deep‑Dive Exercises

• Custom auto‑config & starter: build my-feature-autoconfigure with @AutoConfiguration and AutoConfiguration.imports; publish a starter.
• Bean post‑processor: implement a BeanPostProcessor to wrap services with timers/metrics; verify ordering interactions.
• MVC extensions: custom HandlerMethodArgumentResolver; global exception mapping (@ControllerAdvice); custom HttpMessageConverter (CSV) with content negotiation.
• Request correlation: OncePerRequestFilter adds correlation ID to MDC and response header.
• Security: custom SecurityFilterChain for JWT resource server; custom AuthenticationProvider for API keys.
• Transactions lab: demonstrate self‑invocation pitfall, interface vs class proxies, REQUIRES_NEW effects, TransactionTemplate usage.
• Data performance lab: reproduce N+1, fix via @EntityGraph/fetch join, measure impact; tune Hikari; evaluate second‑level cache.

11) Official Resources (Authoritative)

• Spring Boot Reference — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/
• Spring Framework Core — https://docs.spring.io/spring-framework/reference/core/
• Spring Web MVC — https://docs.spring.io/spring-framework/reference/web/webmvc/
• Transactions — https://docs.spring.io/spring-framework/reference/data-access/transaction/
• Spring Security — https://docs.spring.io/spring-security/reference/
• Spring Data JPA — https://docs.spring.io/spring-data/jpa/docs/current/reference/html/
• Actuator & Metrics — https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#actuator
• Micrometer — https://micrometer.io/
• OpenTelemetry Java — https://opentelemetry.io/docs/languages/java/
• Testcontainers — https://testcontainers.com/

12) Quick Reading Order (Suggested)

1. Boot Reference: SpringApplication, auto‑configuration, externalized config, Actuator.
2. Framework Core: beans, lifecycle, AOP.
3. Web MVC: request handling chain, converters, validation.
4. Security Reference: architecture, JWT resource server.
5. Data JPA: repositories, entity graphs.
6. Testing: slices, Testcontainers.
7. Observability: Micrometer/OTel.