@Configuration
class RestCorsConfig : WebMvcConfigurer {

    override fun addCorsMappings(@NonNull registry: CorsRegistry) {
        registry.addMapping("/**")
            .allowedMethods(HttpMethod.GET.name(), HttpMethod.POST.name(), HttpMethod.DELETE.name())
            .allowedOrigins("*")
    }
}

This allows access to all endpoints from all origins via GET, POST and DELETE methods.

import org.junit.jupiter.api.BeforeAll
import org.springframework.boot.test.context.SpringBootTest
import org.springframework.test.context.DynamicPropertyRegistry
import org.springframework.test.context.DynamicPropertySource
import org.testcontainers.containers.GenericContainer
import org.testcontainers.containers.wait.strategy.HostPortWaitStrategy

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
abstract class RedisTest {
    companion object {
        private const val REDIS_IMAGE = "redis:7-alpine"
        private const val REDIS_PORT = 6379

        private const val REDIS_CONFIG_HOST = "spring.data.redis.host"
        private const val REDIS_CONFIG_PORT = "spring.data.redis.port"

        private val redisContainer = GenericContainer<Nothing>(REDIS_IMAGE).apply {
            withExposedPorts(REDIS_PORT)
            withReuse(true)
        }

        @JvmStatic
        @BeforeAll
        fun beforeAll() {
            if (!redisContainer.isRunning) {
                redisContainer.start()
                redisContainer.setWaitStrategy(HostPortWaitStrategy())
            }
        }

        @JvmStatic
        @DynamicPropertySource
        fun properties(registry: DynamicPropertyRegistry) {
            registry.add(
                REDIS_CONFIG_HOST,
                redisContainer::getContainerIpAddress
            )
            registry.add(
                REDIS_CONFIG_PORT,
                redisContainer::getFirstMappedPort
            )
        }
    }
}

With this in place you can create a simple test by extending RedisTest

import org.assertj.core.api.Assertions.assertThat
import org.junit.jupiter.params.ParameterizedTest
import org.junit.jupiter.params.provider.CsvSource
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.data.redis.core.RedisTemplate

class EventSourceTest @Autowired constructor(
    val redisTemplate: RedisTemplate<String, String>
) : RedisTest() {

    @ParameterizedTest
    @CsvSource(
        value = [
            "test1, 1",
            "test2, 2",
            "test3, 3",
        ]
    )
    fun redis(
        key: String,
        value: String
    ) {
        redisTemplate.opsForValue().set(
            key,
            value
        )
        assertThat(redisTemplate.opsForValue().getAndDelete(key)).isEqualTo(value)
    }

}

Here a simple code sample for generic Crud events in a JPA application:

open class CrudEvent<ID : Serializable, T : AbstractEntity<ID>>

@EventListener
fun onEvent(event: CrudEvent<UUID, User>) {}

Looks good, right? But doesn’t work. You could replace CrudEvent<UUID, User> with CrudEvent<*, *> and it would start receiving events. But of course all and not just for User. Here a simple way to get around this problem:

class UserEvent: CrudEvent<UUID, User>

@EventListener
fun onEvent(event: UserEvent) {}

    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.security:spring-security-oauth2-client")

In your config you need to configure the OIDC server:

spring:
  security:
    oauth2:
      client:
        registration:
          keycloak:
            client-id: <id>
            client-secret: <secret>
            authorization-grant-type: client_credentials
        provider:
          keycloak:
            token-uri: <server-url>/realms/<realm>/protocol/openid-connect/token

In the method you create your WebClient you need to add an oauth filter:

    @Bean
    @Qualifier("keycloak")
    @ConditionalOnMissingBean
    fun keycloakWebClient(
      clientRegistrations: ReactiveClientRegistrationRepository,
      authorizedClientService: ReactiveOAuth2AuthorizedClientService,
    ): WebClient {

        val oauth = ServerOAuth2AuthorizedClientExchangeFilterFunction(
                AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(
                        clientRegistrations, authorizedClientService
                )
        );
        oauth.setDefaultClientRegistrationId("keycloak");

        return WebClient.builder()
            .exchangeStrategies(ExchangeStrategies
                .builder()
                .codecs { clientDefaultCodecsConfigurer: ClientCodecConfigurer ->
                    clientDefaultCodecsConfigurer.defaultCodecs()
                        .jackson2JsonEncoder(Jackson2JsonEncoder(jsonMapper, MediaType.APPLICATION_JSON))
                    clientDefaultCodecsConfigurer.defaultCodecs()
                        .jackson2JsonDecoder(Jackson2JsonDecoder(jsonMapper, MediaType.APPLICATION_JSON))
                }.build()
            )
            .filter(WebClientLoggerBuilder.logRequest())
            .filter(oauth)
            .build()
    }

This results in a WebClient instance using OAuth2 authentication with the server you configured for all calls you use it for. The mapping “keycloak” refers to the key “keycloak” in your application.yml’s spring.security.oauth2.client.registration and spring.security.oauth2.client.provider.

import com.fasterxml.jackson.databind.ObjectMapper
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.http.MediaType
import org.springframework.http.codec.ClientCodecConfigurer
import org.springframework.http.codec.json.Jackson2JsonDecoder
import org.springframework.http.codec.json.Jackson2JsonEncoder
import org.springframework.web.reactive.function.client.ExchangeStrategies
import org.springframework.web.reactive.function.client.WebClient

@Configuration
class WebClientConfig(
    private val jsonMapper: ObjectMapper,
) {

    @Bean
    @ConditionalOnMissingBean
    fun genericWebClient(): WebClient {
        return WebClient.builder()
            .exchangeStrategies(ExchangeStrategies
                .builder()
                .codecs { clientDefaultCodecsConfigurer: ClientCodecConfigurer ->
                    clientDefaultCodecsConfigurer.defaultCodecs()
                        .jackson2JsonEncoder(Jackson2JsonEncoder(jsonMapper, MediaType.APPLICATION_JSON))
                    clientDefaultCodecsConfigurer.defaultCodecs()
                        .jackson2JsonDecoder(Jackson2JsonDecoder(jsonMapper, MediaType.APPLICATION_JSON))
                }.build()
            )
            .filter(WebClientLoggerBuilder.logRequest())
            .build()
    }
}

This defines a bean genericWebClient with Spring Boot configured Jackson ObjectMapper instance.

Here is also the code for the WebClientLoggerBuilder:

import org.springframework.web.reactive.function.client.ClientRequest
import org.springframework.web.reactive.function.client.ExchangeFilterFunction
import reactor.core.publisher.Mono
import java.util.function.Consumer
import org.slf4j.Logger
import org.slf4j.LoggerFactory

object WebClientLoggerBuilder {

    private val log: Logger = LoggerFactory.getLogger(javaClass)

    fun logRequest(): ExchangeFilterFunction {
        return ExchangeFilterFunction.ofRequestProcessor { clientRequest: ClientRequest ->
            if (log.isDebugEnabled) {
                val sb = StringBuilder("Request: \n")
                    .append(clientRequest.method())
                    .append(" ")
                    .append(clientRequest.url())
                    .append("\n")
                clientRequest.headers()
                    .forEach { name: String?, values: List<String?> ->
                        values.forEach(
                            Consumer { value: String? -> sb.append(name).append(": ").append(value).append("\n") })
                    }
                log.debug(sb.toString())
            }
            Mono.just(clientRequest)
        }
    }
}

This simply logs method, path and headers of a request if debug log is enabled and added to the WebClient. Executing a blocking call that parses JSON to a list of objects is then quite easy:

fun <T> queryListWithoutBody(
    path: String,
    listClass: Class<T>,
    params: MultiValueMap<String, String>
): List<T> {
    return webClient.get()
        .uri { it.path(path).queryParams(params).build() }
        .retrieve()
        .bodyToFlux(listClass)
        .collectList()
        .block() ?: emptyList()
}

With this code you’re able to replace RestTemplate without going reactive. Adding spring-boot-starter-webflux also won’t enable netty if you also have good old spring-boot-starter-web in the classpath.

1: Task failed with an exception.
-----------
* What went wrong:
Execution failed for task ':app:processResources'.
> Entry ... is a duplicate but no duplicate handling strategy has been set. Please refer to https://docs.gradle.org/7.5.1/dsl/org.gradle.api.tasks.Copy.html#org.gradle.api.tasks.Copy:duplicatesStrategy for details.

The simple solution is to add the following top level config in your gradle file:

tasks.withType<Copy> {
    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
}

org.springframework.context.ApplicationContextException: Unable to start web server; nested exception is org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat
…
Caused by: java.lang.IllegalStateException: StandardEngine[Tomcat].StandardHost[localhost].TomcatEmbeddedContext[] failed to start

Digging a bit deeper I found the real reason:

java.lang.NoClassDefFoundError: javax/annotation/PostConstruct

This can be fixed by also including javax.annotation:javax.annotation-api as a dependency. The new jakarta based library only includes jakarta.annotation.* but not javax.annotation.*. But Spring Boot still requires the old namespace to work. I didn’t dig deeper why including the dependency broke the app though it was working before without both of the dependencies.

Another great sample for how convenient this rename is and further will be.

The annotation @Log4j allows to create a log4j logger field in the annotated class. This of course implicates that your project is using Log4j for logging and could make your application vulnerable to log4shell if not updated to latest release.

I would highly recommend using @Slf4j instead of @Log4j and use the Simple Logging Facade 4 Java functionality to be able to replace the logging implementation by simply changing some configs and/or libraries instead of changing your code for doing so.

Sample with @Log4j:

@Log4j
class SampleLog4j {

  public void soSomething() {
    log.debug("this is a log4j log message");
  }

}

The same sample using slf4j:

@Slf4j
class SampleLog4j {

  public void soSomething() {
    log.debug("this is a slf4j log message");
  }

}

As you can see for simple string messages there is no difference at all. A big difference comes in place when it comes to parameterised log messages which log like the following with slf4j:

log.error("this is a {} error message", someVar, exception);

Taken from my knowledge with log4j (which was going down over the years of using slf4j already) there would be a way with ParameterizedMessage or simple String.format to achieve the same:

// with String.format
log.error(String.format("this is a %s error message", someVar), exception);

// or string concatenation
log.error("this is a " + someVar + " error message", exception);

// or with ParameterizedMessage
log.error(new ParameterizedMessage("this is a {} error message", someVar), exception);

I don’t think that ParameterizedMessage is really used a lot and most people rely on string concatenation or String.format. From that perspective: Biggest difference are the used log levels: Slf4j doesn’t know the fatal log level – see https://www.slf4j.org/faq.html#fatal. If you’re happy the do some changes on that you should be able to replace @Log4j with @Slf4j after having taken care about fatal. Of course this assumes you’re doing nothing fancy with your logger ;-) Also checkout the migrator tool: https://www.slf4j.org/migrator.html.

If you’re in a JEE environment with jboss/wildfly/eap (or simply used to it) also @JBossLog could be interesting to you which would generate a jboss-logger instance for you that would also not be vulnerable to log4shell but is also naming a logging implementation directly in your code instead of using a facade.

Checkout the lombok external logger implementations yourself under https://projectlombok.org/api/index.html.

{
  "group": "dev.mbo",
  "name": "gradle-status-test",
  "version": "1.0.0",
  "dependencies": {
    "org.apache.commons:commons-lang3:3.12.0": {
      "group": "org.apache.commons",
      "name": "commons-lang3",
      "version": "3.12.0",
      "project": false,
      "configurations": [
        "compileClasspath",
        "default",
        "runtimeClasspath",
        "testCompileClasspath",
        "testRuntimeClasspath"
      ]
    },
    "commons-io:commons-io:2.11.0": {
      "group": "commons-io",
      "name": "commons-io",
      "version": "2.11.0",
      "project": false,
      "configurations": [
        "compileClasspath",
        "default",
        "runtimeClasspath",
        "testCompileClasspath",
        "testRuntimeClasspath"
      ]
    },
    "gradle-status-test:module2:1.0.0": {
      "group": "gradle-status-test",
      "name": "module2",
      "version": "1.0.0",
      "project": true,
      "configurations": [
        "compileClasspath",
        "default",
        "implementation",
        "runtimeClasspath",
        "runtimeElements",
        "testCompileClasspath",
        "testImplementation",
        "testRuntimeClasspath"
      ]
    },
    "com.fasterxml.jackson.core:jackson-databind:2.13.0": {
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.13.0",
      "project": false,
      "configurations": [
        "default",
        "runtimeClasspath",
        "testRuntimeClasspath"
      ]
    },
    "com.fasterxml.jackson.core:jackson-annotations:2.13.0": {
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-annotations",
      "version": "2.13.0",
      "project": false,
      "configurations": [
        "default",
        "runtimeClasspath",
        "testRuntimeClasspath"
      ]
    },
    "com.fasterxml.jackson:jackson-bom:2.13.0": {
      "group": "com.fasterxml.jackson",
      "name": "jackson-bom",
      "version": "2.13.0",
      "project": false,
      "configurations": [
        "default",
        "runtimeClasspath",
        "testRuntimeClasspath"
      ]
    },
    "com.fasterxml.jackson.core:jackson-core:2.13.0": {
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-core",
      "version": "2.13.0",
      "project": false,
      "configurations": [
        "default",
        "runtimeClasspath",
        "testRuntimeClasspath"
      ]
    },
    "org.junit:junit-bom:5.8.2": {
      "group": "org.junit",
      "name": "junit-bom",
      "version": "5.8.2",
      "project": false,
      "configurations": [
        "testCompileClasspath",
        "testRuntimeClasspath"
      ]
    },
    "org.junit.jupiter:junit-jupiter-api:5.8.2": {
      "group": "org.junit.jupiter",
      "name": "junit-jupiter-api",
      "version": "5.8.2",
      "project": false,
      "configurations": [
        "testCompileClasspath",
        "testRuntimeClasspath"
      ]
    },
    "org.opentest4j:opentest4j:1.2.0": {
      "group": "org.opentest4j",
      "name": "opentest4j",
      "version": "1.2.0",
      "project": false,
      "configurations": [
        "testCompileClasspath",
        "testRuntimeClasspath"
      ]
    },
    "org.junit.platform:junit-platform-commons:1.8.2": {
      "group": "org.junit.platform",
      "name": "junit-platform-commons",
      "version": "1.8.2",
      "project": false,
      "configurations": [
        "testCompileClasspath",
        "testRuntimeClasspath"
      ]
    },
    "org.apiguardian:apiguardian-api:1.1.2": {
      "group": "org.apiguardian",
      "name": "apiguardian-api",
      "version": "1.1.2",
      "project": false,
      "configurations": [
        "testCompileClasspath"
      ]
    },
    "org.junit.jupiter:junit-jupiter-engine:5.8.2": {
      "group": "org.junit.jupiter",
      "name": "junit-jupiter-engine",
      "version": "5.8.2",
      "project": false,
      "configurations": [
        "testRuntimeClasspath"
      ]
    },
    "org.junit.platform:junit-platform-engine:1.8.2": {
      "group": "org.junit.platform",
      "name": "junit-platform-engine",
      "version": "1.8.2",
      "project": false,
      "configurations": [
        "testRuntimeClasspath"
      ]
    }
  },
  "subprojects": [
    {
      "group": "gradle-status-test",
      "name": "module1",
      "version": "1.0.0",
      "dependencies": {
        "com.fasterxml.jackson.core:jackson-databind:2.13.0": {
          "group": "com.fasterxml.jackson.core",
          "name": "jackson-databind",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "compileClasspath",
            "default",
            "runtimeClasspath",
            "testCompileClasspath",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson.core:jackson-annotations:2.13.0": {
          "group": "com.fasterxml.jackson.core",
          "name": "jackson-annotations",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "compileClasspath",
            "default",
            "runtimeClasspath",
            "testCompileClasspath",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson:jackson-bom:2.13.0": {
          "group": "com.fasterxml.jackson",
          "name": "jackson-bom",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "compileClasspath",
            "default",
            "runtimeClasspath",
            "testCompileClasspath",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson.core:jackson-core:2.13.0": {
          "group": "com.fasterxml.jackson.core",
          "name": "jackson-core",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "compileClasspath",
            "default",
            "runtimeClasspath",
            "testCompileClasspath",
            "testRuntimeClasspath"
          ]
        }
      },
      "subprojects": []
    },
    {
      "group": "gradle-status-test",
      "name": "module2",
      "version": "1.0.0",
      "dependencies": {
        "org.apache.commons:commons-lang3:3.12.0": {
          "group": "org.apache.commons",
          "name": "commons-lang3",
          "version": "3.12.0",
          "project": false,
          "configurations": [
            "compileClasspath",
            "default",
            "runtimeClasspath",
            "testCompileClasspath",
            "testRuntimeClasspath"
          ]
        },
        "gradle-status-test:module1:1.0.0": {
          "group": "gradle-status-test",
          "name": "module1",
          "version": "1.0.0",
          "project": true,
          "configurations": [
            "compileClasspath",
            "default",
            "implementation",
            "runtimeClasspath",
            "runtimeElements",
            "testCompileClasspath",
            "testImplementation",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson.core:jackson-databind:2.13.0": {
          "group": "com.fasterxml.jackson.core",
          "name": "jackson-databind",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "default",
            "runtimeClasspath",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson.core:jackson-annotations:2.13.0": {
          "group": "com.fasterxml.jackson.core",
          "name": "jackson-annotations",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "default",
            "runtimeClasspath",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson:jackson-bom:2.13.0": {
          "group": "com.fasterxml.jackson",
          "name": "jackson-bom",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "default",
            "runtimeClasspath",
            "testRuntimeClasspath"
          ]
        },
        "com.fasterxml.jackson.core:jackson-core:2.13.0": {
          "group": "com.fasterxml.jackson.core",
          "name": "jackson-core",
          "version": "2.13.0",
          "project": false,
          "configurations": [
            "default",
            "runtimeClasspath",
            "testRuntimeClasspath"
          ]
        }
      },
      "subprojects": []
    }
  ]
}

The structure under subprojects is simply the same but nested recursively. `project=true` means that the dependecy is a project(“:name”) dependency.

Under https://github.com/mbogner/schema-validator I came up with a solution that enables you to validate against a JSON Schema or against a custom map that holds schema information. Both values can be stored in the database and validate a map that can be used to map JSONB fields. It is based on a javax.validation class level validator that allows you to have your json as a map and your schema in a second field.

Checkout https://github.com/mbogner/schema-validator to see the code. I would be happy to hear your opinion or other ways to reach the goal in a maybe easier way.