springboot-patterns

Use thin @RestController classes that delegate to @Service classes, which in turn call Spring Data JPA repositories. Controllers handle HTTP concerns and DTO mapping, services hold business logic with @Transactional, and repositories stay as simple interfaces extending JpaRepository.

Create a @ControllerAdvice class with an @ExceptionHandler for MethodArgumentNotValidException that collects field errors into a single message. Return a structured error body with HTTP 400, and add handlers for AccessDeniedException and generic Exception for 403 and 500 responses.

Yes, you must add @EnableCaching to a configuration class before annotations like @Cacheable and @CacheEvict take effect. Then annotate service methods with @Cacheable(value, key) to cache results and @CacheEvict to invalidate entries.

Clients can spoof the X-Forwarded-For header, so reading it directly lets attackers bypass IP-based rate limits. Only trust it behind a configured reverse proxy with server.forward-headers-strategy set and ForwardedHeaderFilter registered; otherwise use request.getRemoteAddr().

Use @Transactional(readOnly = true) on query-only service methods to signal the persistence provider that no writes occur, enabling optimizations like skipping dirty checking. Reserve read-write transactions for methods that create, update, or delete entities.