Develop Reference

Java Spring Force developers to set permission annotation at http endpoints

I want to protect all http endpoints with spring security annotations. Is there a way to punish developers that forget setting annotations on methods. Spring configuration? Or do I have to write my own AOP/Reflection code that does this at compile time?

just add spring security core maven dependency on your pom file , with this configuration spring will secure your all endpoints.
it will generate username as user and password will show on your console and you can also configure it manually.

Spring Webflux - Actuator - Netty thread metrics?

Small question regarding Netty metrics for a Spring Webflux + actuator project please.
In the Spring MVC world, combined with actuator, we have metrics such as:
tomcat_threads_busy_threads
tomcat_threads_current_threads
tomcat_threads_config_max_threads
jetty_threads_busy
jetty_threads_current
jetty_threads_config_max
Which helps a lot to get the overall status of the application.
However, in Webflux, it seems there is no equivalent.
I was expecting something like netty_threads_busy or something equivalent, but could not find anything related.
May I ask what would be the equivalent in Netty Webflux world please?
Thank you

The metrics expose by reactor-netty are not enabled by default in spring boot. There was a previous discussion on this github issue and the decision was not to enable these by default.
If you wanted to enable the netty server metrics in your own application, you can add the following bean to customise the Netty HttpServer.
#Bean
public NettyServerCustomizer nettyServerCustomizer(){
return httpServer -> httpServer.metrics(true, uriMappingFunction);
}
Caveat:
If you have path parameters in any of your URIs you should provide a uriMappingFunction that converts them to templated URIs ie. /user/1 -> /user/{id}. Failure to do so could lead to cardinality explosion in your MeterRegistry.
Enabling this feature also comes with the following recommendation:
It is strongly recommended applications to configure an upper limit for the number of the URI tags.
Reference Documentation
Java Doc

Use Spring Boot with explicitly configuration

Is it possible to use Spring Boot so that all configurations are explicitly in the main class?
For example, is it possible to tell spring-boot to print all autoconfigurations make by #SpringBootApplication so that I can copy paste in my main class?
Or is it possible to copy then from somewhere into the main?

You can have Spring Boot create a report (a list of auto configurations) simply by enabling debug mode in your application.properties file:
debug = true
The auto-configuration report contains information about the classes that Spring Boot found on the classpath and configured automatically. It also shows information about classes that are known to Spring Boot but were not found on the classpath.
And, because you've set debug=true in application.properties or application.yml, so you will see it in your output.

There is no way of doing this. Either you embrace the devil and suffer the consequences latter if you need to personalize something unpredictable by spring boot developers or you don't use it's magic.

Where does Spring Boot store its default logging settings

I'm creating a Java Spring Boot 2.X application. In my configuration (application.yml), I have added the following property:
logging:
file: ${spring.applicaton.name}.log
This seems to work out of the box. However, I'm curious where the underlying default log configurations reside. Using google I found out that Spring Boot uses logback, but I cannot see a logback-spring.xml file. Also this other question seems to mention log4j2 instead of logback - does that work because they added a dependency on log4j2 (I have not added any dependency except for the sprint boot starter). what I also observed is that the two main logging mechanisms seem to be a rolling file appender and the console logger. Where is this defined?
My question is: where does Spring Boot pick up its default log configuration? I found these configuration files but I'm not sure if they are correct. Their naming convention and syntax is not what I expected. how do you choose a specific logging implementation - by dependencies or by configuration?

The default Logback configuration is stored in:
spring-boot-2.1.1.RELEASE.jar
/org/springframework/boot/logging/logback/base.xml
The default Log4j2 configuration is stored in:
spring-boot-2.1.1.RELEASE.jar
/org/springframework/boot/logging/log4j2/log4j2-file.xml
The default Java Util Logging configuration is stored in:
spring-boot-2.1.1.RELEASE.jar
/org/springframework/boot/logging/java/logging-file.properties
Note: The version of the jar file varies, of course.
Spring defaults to Logback. Read the Spring documentation for how to specify a different implementation and for how to configure it.

Dynamic | User case Based logging

Is there any logging framework, which helps me change logging levels dynamically based on the request parameters received ?
If request has a parameter with debug enabled to true, then only it should log, else not.
Does spring sleuth provide this feature in cloud environment?

You can use Spring Boot & Spring Cloud Config and standard Slf4j logging mechanism. You can check out this answer for more information - Managing logging.level using ConfigServer

If you just want conditional logging you would use a NDC/MDC and a filter using the frameworks that support that feature.
If you want something more general then for instance, setup a com.foo.request that is set to say INFO and a com.foo.request.debug that is set to some lower level. Pick and choose the logger on request parameter.