Skip to content

Spring Boot Engineering Standard

Version: 1.0.0

Status: official

Author: Enterprise AI Standards

Description

Official engineering standard for developing enterprise applications using Spring Boot.

Objective

Define mandatory standards for designing, implementing and maintaining Spring Boot applications that are scalable, secure, maintainable and cloud-ready.

Philosophy

Spring Boot should simplify development, not hide architectural decisions. Every application must be modular, testable, observable and production-ready from day one.

Principles

  • Convention over configuration.
  • Feature-based package organization.
  • Constructor Injection only.
  • Stateless services.
  • Hexagonal Architecture preferred.
  • SOLID principles mandatory.
  • Fail Fast.
  • Configuration externalized.
  • Infrastructure separated from business logic.

Project Structure

  • rules

Language Features

Virtual Threads

Structured Concurrency

Records

Sealed Classes

Pattern Matching

Collections

Streams

Optional

Exceptions

  • @RestControllerAdvice mandatory.
  • RFC7807 Problem Details preferred.
  • Never expose stack traces.

Logging

  • SLF4J.
  • Structured Logging.
  • Correlation IDs.
  • Never System.out.println().

Performance

  • Virtual Threads.
  • HikariCP.
  • Lazy initialization only when justified.
  • Measure before optimization.

Security

  • Spring Security mandatory.
  • JWT preferred.
  • BCrypt passwords.
  • HTTPS only.
  • CORS configured.
  • CSRF disabled only for stateless APIs.

Testing

  • JUnit 5.
  • Mockito.
  • Testcontainers.
  • Spring Boot Test.
  • Integration Tests mandatory.

Observability

  • Spring Boot Actuator.
  • Micrometer.
  • OpenTelemetry.
  • Prometheus.
  • Grafana.

Documentation

  • SpringDoc OpenAPI.
  • README mandatory.
  • Architecture diagram required.

Best Practices

  • Constructor Injection.
  • Records for DTOs.
  • Immutable objects.
  • Small services.
  • One endpoint per use case.
  • Explicit configuration.

Anti Patterns

  • Field Injection.
  • Fat Controllers.
  • Fat Services.
  • Entity exposure.
  • Circular dependencies.
  • Business logic inside Controllers.
  • Static state.
  • Repository business logic.

Review Checklist

  • [ ] Java 25
  • [ ] Spring Boot Latest
  • [ ] Virtual Threads
  • [ ] REST API
  • [ ] Validation
  • [ ] Global Exception Handler
  • [ ] JWT
  • [ ] Flyway
  • [ ] PostgreSQL
  • [ ] Testcontainers
  • [ ] OpenAPI
  • [ ] Docker
  • [ ] Health Checks
  • [ ] Observability
  • [ ] README Updated

Examples

References

  • https://spring.io/projects/spring-boot
  • https://docs.spring.io/spring-boot/
  • https://spring.io/projects/spring-security
  • https://spring.io/projects/spring-data-jpa
  • https://springdoc.org/