Backend Aug 19, 2026 4 min read
Spring Boot, Micrometer, and OpenTelemetry Instrumentation
Instrument a Spring order service with Actuator, Micrometer Observation, tracing, OTLP, bounded dimensions, and tested propagation.
Category
Backend
41 articles in this category. Use this page as a focused path through related backend concepts.
Backend Aug 5, 2026 10 min read
Production Spring Boot Backend Systems Explained
Build a production-minded Spring Boot order service by separating HTTP, application, data, security, configuration, operations, testing, and incident-recovery layers.
Backend Aug 5, 2026 10 min read
Production Spring Boot Incident Troubleshooting
Troubleshoot Spring Boot incidents from evidence through reversible mitigation, rollback, and recovery verification across correctness, users, and resources.
Backend Aug 5, 2026 11 min read
Spring Boot Actuator, Health, and Metrics Explained
Operate Spring Boot with minimal Actuator exposure, safe health groups, liveness and readiness boundaries, low-cardinality metrics, and graceful shutdown.
Backend Aug 5, 2026 10 min read
Spring Boot Exception Handling Explained
Design safe Spring Boot error responses with ProblemDetail and RFC 9457 while respecting MVC, filter, security, async, and committed-response boundaries.
Backend Aug 5, 2026 11 min read
Spring Boot Configuration Properties, Profiles, and Secrets Explained
Use typed Spring Boot configuration, deliberate property precedence, environment profiles, secret injection, and drift evidence without exposing operational control planes.
Backend Aug 5, 2026 10 min read
Spring Boot Request Validation Explained
Separate Spring Boot request-shape validation from authorization and concurrency-safe business invariants, including nested DTO and collection validation.
Backend Aug 5, 2026 11 min read
Spring Data JPA Query Performance Explained
Diagnose Spring Data JPA performance with query, SQL, plan, row, pool-wait, and user-latency evidence instead of relying on fetch-strategy folklore.
Backend Aug 5, 2026 11 min read
Spring Boot Integration Testing with Testcontainers Explained
Use Spring test slices, full-context contracts, Testcontainers PostgreSQL, migrations, security, and failure injection without overstating production equivalence.
Backend Aug 5, 2026 12 min read
Spring Security Filter Chain and Authorization Explained
Design ordered Spring Security filter chains, deny-by-default request and method authorization, resource ownership checks, and safe browser boundaries.
Backend Aug 5, 2026 12 min read
Spring Service Layers and Transaction Boundaries Explained
Design Spring application services and transactions that preserve local order invariants without hiding proxy, rollback, thread, remote-call, or side-effect boundaries.
Backend Jul 2, 2026 5 min read
API Abuse Prevention Explained
Learn API abuse prevention for backend systems, including rate limits, authentication signals, quotas, bot patterns, logging, errors, and gateways.
Backend Jul 2, 2026 6 min read
API Authentication Best Practices
Learn API authentication best practices, including tokens, API keys, OAuth, mTLS, sessions, gateways, rotation, scopes, errors, and logging.
Backend Jul 2, 2026 5 min read
Cookie Security Checklist
Use this backend cookie security checklist for HttpOnly, Secure, SameSite, CSRF, session rotation, prefixes, expiration, domains, and testing.
Backend Jul 2, 2026 6 min read
Cookie vs Token Authentication
Compare cookie and token authentication for backend apps, including sessions, JWTs, CSRF, XSS, storage, CORS, mobile clients, and API tradeoffs.
Backend Jul 2, 2026 5 min read
CORS Preflight Explained
Learn how CORS preflight requests work, including OPTIONS handling, allowed methods, headers, credentials, caching, errors, and backend mistakes.
Backend Jul 2, 2026 5 min read
OAuth Client Credentials Flow Explained
Learn the OAuth client credentials flow for service-to-service APIs, including clients, secrets, scopes, tokens, rotation, and security risks.
Backend Jul 2, 2026 4 min read
OAuth Scopes Explained
Learn OAuth scopes for backend APIs, including permissions, consent, least privilege, access tokens, naming, validation, and common mistakes.
Backend Jul 2, 2026 5 min read
Security Event Logging Explained
Learn security event logging for backend systems, including auth events, API abuse signals, safe metadata, alerting, retention, and mistakes.
Backend Jul 2, 2026 5 min read
Service Accounts Explained
Learn service accounts for backend systems, including machine identity, API access, least privilege, secrets, rotation, audit logs, and risks.
Backend Jul 1, 2026 6 min read
Audit Logs Explained for Backend Systems
Learn what audit logs are in backend systems, including actor, action, resource, timestamp, metadata, retention, privacy, and investigation workflows.
Backend Jul 1, 2026 6 min read
Least Privilege Explained for Backend Developers
Learn the principle of least privilege for backend systems, including users, services, API keys, database roles, cloud permissions, and operational tradeoffs.
Backend Jul 1, 2026 6 min read
Secret Management Explained for Backend Developers
Learn secret management for backend apps, including environment variables, secret stores, rotation, least privilege, logging risks, and deployment workflows.
Backend Jul 1, 2026 5 min read
Spring Boot REST Controller Explained
Learn Spring Boot REST controllers, including @RestController, request mappings, DTOs, validation, status codes, error responses, and testing.
Backend Jun 30, 2026 5 min read
API Key Design Best Practices for Backend APIs
Learn practical API key design best practices, including key format, prefixes, hashing, scopes, rotation, rate limits, audit logs, and safe storage.
Backend Jun 30, 2026 5 min read
API Key vs OAuth Token: Practical Backend Differences
Compare API keys and OAuth tokens for backend APIs, including identity, scopes, rotation, expiration, user context, service access, and security tradeoffs.
Backend Jun 30, 2026 5 min read
MFA Explained for Web Apps
Learn how multi-factor authentication works in web apps, including TOTP, WebAuthn, backup codes, recovery flows, step-up checks, and backend tradeoffs.
Backend Jun 30, 2026 5 min read
Password Hashing Explained for Backend Developers
Learn password hashing basics for backend systems, including salts, slow hashes, peppers, verification, resets, storage risks, and common mistakes.
Backend Jun 30, 2026 4 min read
RBAC vs ABAC: Access Control Models Explained
Compare RBAC and ABAC for backend authorization, including roles, attributes, policies, ownership checks, tenant context, and practical tradeoffs.
Backend Jun 30, 2026 5 min read
Refresh Token Rotation Explained for Backend Developers
Learn how refresh token rotation works, why reuse detection matters, and how backend teams can design safer token refresh, logout, and revocation flows.
Backend Jun 30, 2026 5 min read
SameSite Cookies Explained for Backend Developers
Learn how SameSite cookies affect browser authentication, CSRF risk, cross-site requests, OAuth redirects, iframes, and backend cookie design.
Backend Jun 30, 2026 5 min read
Secure HTTP Headers Explained for Backend Developers
Learn practical secure HTTP headers for backend apps, including HSTS, CSP, X-Content-Type-Options, frame protection, referrer policy, and cookie-related limits.
Backend Jun 30, 2026 4 min read
Session Fixation Explained for Backend Developers
Learn what session fixation is, how it affects web authentication, why session rotation matters, and how backend teams can prevent it.
Backend Jun 29, 2026 4 min read
Authorization vs Authentication
Compare authentication and authorization in backend systems, including identity checks, permissions, roles, scopes, sessions, tokens, and API enforcement.
Backend Jun 29, 2026 4 min read
CORS Explained for Backend Developers
Learn how CORS works for backend APIs, including origins, preflight requests, credentials, allowed headers, cookies, security limits, and common mistakes.
Backend Jun 29, 2026 4 min read
JWT Claims Explained
Learn common JWT claims for backend authentication, including sub, iss, aud, exp, nbf, iat, jti, scopes, roles, tenant context, and validation mistakes.
Backend Jun 29, 2026 5 min read
OAuth 2.0 vs OpenID Connect
Compare OAuth 2.0 and OpenID Connect for backend developers, including authorization, login, ID tokens, access tokens, scopes, and common mistakes.
Backend May 3, 2026 7 min read
CSRF vs XSS: Key Differences for Backend Developers
Compare CSRF and XSS attacks for backend developers, including how they work, why cookies and tokens matter, and practical defenses.
Backend Apr 19, 2026 6 min read
OAuth 2.0 Explained for Backend Developers
A backend-focused OAuth 2.0 guide covering roles, authorization code flow, PKCE, scopes, tokens, client credentials, and common mistakes.
Backend Apr 12, 2026 6 min read
Access Token vs Refresh Token
Compare access tokens and refresh tokens in backend authentication, including lifetime, storage, rotation, revocation, and security tradeoffs.
Backend Jan 28, 2026 5 min read
JWT vs Session Authentication: Practical Backend Tradeoffs
Understand JWT and server-side session authentication, including storage, revocation, scaling, security risks, and common backend use cases.