Spring blog

All Posts
Engineering
Releases
News and Events

This Week in Spring - Aug 27th, 2013

Engineering | Josh Long | August 27, 2013 | ...

Welcome back to another installment of This Week in Spring. We have a lot to cover, as usual! Spring Security and lead Rob Winch feature heavily in this week's roundup! So, cheers to Rob Winch!

  1. Spring Security lead Rob Winch put together a post introducing some of the new, smart and convenient protection in Spring Security against cross-site request forgery (or CSRF).
  2. Rob also put together another epic blog post that demonstrates some of Spring Security's new support for security headers.
  3. Rob was also kind enough to integrate these new features into the Spring REST stack codebase where you can see them in action in the context of a full-stack, integrated Spring REST service. To see these changes, along with Spring Security and Spring Security OAuth, all integrated using Java Configuration, check out the oauth module.
  4. Reactor lead Jonathan Brisbin has announced Reactor 1.0.0.M2 is now available. The new release looks very exciting! From Jon's writeup: "This 2nd milestone includes a number of bugfixes and some really exciting new features. Reactor now includes a Processor abstraction, which is a highly-optimized task processor based on the LMAX Disruptor RingBuffer… Anecdotal benchmarks on a MacBook Pro show the Processor can pump around 100,000,000 events per second through the pipeline. Yes, you read that right: 100 million per second!"
  5. Hyperic, Cloud Foundry, Spring and Spring Data ninja Jennifer Hickey has announced the latest cut of the Spring Data Redis project. The new release includes support for millisecond precision in key expiration commands, resubscription of message listeners on connection failure, a full implementation of ConcurrentMap contract in RedisMap and RedisProperties
  6. Spring Batch lead Michael Minella has announced Spring Batch 3.0M1 has been released! This release marks the first steps towards implementing the JSR-352 Java Batch specification, among other things.
  7. Register now for the Aug 29th Webinar: Taming Coupling & Cohesive Beasts with Modularity Patterns and Spring with Param Rengaiah.
  8. Join our friends from Pivotal Labs as David Frank shows you How to Get Agile with Pivotal Tracker, on September 5th.
  9. Spring Security lead Rob Winch tweeted, "#Gradle made it dead simple to build #SpringSecurity with #SpringFramework 3 and run tests with both #Spring 3/4," and linked to this epic example. This isn't strictly speaking Spring related post, but it's a nice example of a really elegant Gradle build, for those who also work with it, as we do at SpringSource.
  10. Spring Security lead Rob Winch (boy, that guy sure gets around!) also announced the latest release of Spring Security LDAP.
  11. Our pal Xavier Padró is back, this time with a post introducing how to use resource-local JMS transactions on message receipt with Spring's JmsTemplate.
  12. Patrick Grimard's put together a nice post on integrating Yeoman Backbone with a Spring web application, as well as a way to sidestep some issues he was having with resource resolution by using Tuckey’s UrlRewriteFilter. Now, I like the UrlRewriteFilter. That said, I think (but haven't tested..) that Patrick could've accomplished the same thing using Spring MVC resource handling support, as he starts to do in an example in the code when overriding the public void addResourceHandlers(ResourceHandlerRegistry registry) configuration method. Perhaps I'm mistaken, and either way, cool post!
  13. SpringSource has released new trainings to the Q3 schedule, check out the training schedules for: Core Spring, Enterprise Integration with Spring and Spring Web.
Read more

Reactor 1.0.0.M2 – a foundation for reactive fast-data applications on the JVM

Engineering | Jon Brisbin | August 27, 2013 | ...

I'm excited to announce the 2nd milestone release of Reactor on our way toward 1.0! Maven artifacts for Reactor 1.0.0.M2 are available in the usual milestone repository.

What is Reactor?

Reactor is a foundational framework for building high-throughput, asynchronous, reactive applications on the JVM. It provides Selector-style topic matching for event routing, dynamic Consumer assignment, an uber-fast task processor, and reactive Stream and Promise APIs for working with data asynchronously and coordinating asynchronous tasks. It comes with comprehensive Groovy language support by providing langauge extensions to make writing Reactor applications in Groovy pretty darned Groovy! It also has easy-to-use Spring support that automagically wires annotated POJOs to Reactors.

What's in this Release?

This 2nd milestone includes a number of bugfixes and some really exciting new features. Reactor now includes a Processor abstraction, which is a highly-optimized task processor based on the LMAX Disruptor RingBuffer. It uses the common abstractions from Reactor to configure a RingBuffer and allows you to use Reactor's common API instead of the Disruptor-specific API. It also by design skips the Selector matching and dynamic Consumer assignment provided by a Reactor in order to wring every last drop of throughput it can. Anecdotal benchmarks on a MacBook Pro show the Processor can pump around 100,000,000 events per second through the pipeline. Yes, you read that right: 100 million per second!

1.0.0.M2 also includes a small, but significant new feature in the Reactor API which optimizes event publishing in a Reactor to get about 30-50% higher throughput. It won't suit every situation since it prepares an optimized list of Consumers from the Reactor, but for an extra 10 million events per second in throughput, it's a great new feature.

Optimized Publish

One of the powerful aspects of Reactor is the Selector matching topic(ish) pub/sub. It allows you to easily assign handlers to events using topics, anonymous objects, assignable type hierarchies, URI path matching, or regular expressions (or any other type of Selector matching if you implement your own, domain-specific Selectors). But many applications can assign their handlers at startup, which means the path to those Consumers can be optimized for efficient event publication. The new Reactor method prepare(Object) allows you to pre-select the Consumers for a key. It returns a Consumer itself that event publishers can use to efficiently notify about new events.

// Create Environment in which Reactors operate
Environment env = new Environment();
Reactor reactor = Reactors.reactor().env(env).get();

reactor.on($("say.hello"), new Consumer<Event<String>>() {
	public void accept(Event<String> ev) {
		System.out.println("Hello " + ev.getData() + "!");
	}
});

Consumer<Event<String>> sayHello = reactor.prepare("say.hello");
for(String name : listOfNames) {
	sayHello.accept(name);
}

RingBuffer Task Processor

Reactor 1.0.0.M2 includes the Processor abstraction. It is a simple task processor backed by the LMAX Disruptor RingBuffer and is designed to integrate it seamlessly into the reactive APIs used in Reactor, so it uses common abstractions like Supplier and Consumer. A fully-configured Processor can be created in a single expression and using Java 8 lambdas is more succinct yet:

Processor<Message> proc = new ProcessorSpec<Message>()
	.dataSupplier({ return new Message(); })
	.consume({ msg -> // handle the updated Message object…
Read more

Spring Batch 3.0 Milestone 1 Released

Engineering | Michael Minella | August 23, 2013 | ...

Today we are pleased to announce the first milestone release towards Spring Batch 3.0 (download). With this release we take our first steps towards implementing the JSR-352 Java Batch specification. Spring Batch is a lightweight, comprehensive framework for the development of robust batch applications.

JSR-352

JSR-352 is billed as the standardization of batch processing for the java platform. As part of that standardization, this JSR has included three main pieces:

  • A XML based DSL for configuring jobs
  • An API for creating job related components (readers/writers/etc)
  • An API and description of behavior for a supporting classes and concepts

Spring has invested a large amount of time and resources in our contribution to this spec. Our collaboration with the other industry experts via the JCP, JSR-352 validates that the batch patterns that Spring Batch has implemented and battle tested over the past five years in countless production environments is the best approach for building mission critical batch applications.

Features in Milestone 1

This release is the first step towards Spring Batch being compliant with the JSR. Out of the 155 SE tests in the JSR-352 TCK, this release passes 70. The specific features implemented within this release are:

  • JobOperator implementation
  • Basic Job configuration via XML
  • batch.xml support

JobOperator

The JSR defines a JobOperator interface that is a combination of Spring Batch's JobOperator and JobExplorer interfaces. For the spec, this interface serves as the entry point for a batch application to both interact with the job itself (start/stop/restart/etc) as well as the job repository (providing the ability to query for previously run JobExecutions for example). Because of this, the JobOperator needs to provide a level of services out of the box. The JsrJobOperator (the Spring implementation of javax.batch.operations.JobOperator) bootstraps a Spring context similar to that of @EnableBatchProcessing. Out of the box, it includes a JobRepository, JobLauncher, JobOperator, JobExplorer, DataSource, TransactionManager, ParametersConverter, JobRegistry, and a PlaceholderPropertiesConfigurer. All of these can be overridden at runtime by overriding the default beans via the context provided when starting or restarting a job. By default, the JobRepository utilizes HSQLDB in an in-memory configuration.

Per the JSR, to launch a job is actually very easy:

JobOperator jobOperator = BatchRuntime.getJobOperator();
JobExecution jobExecution = jobOperator.start("jsrJob", new Properties());

The above two lines will bootstrap the previously defined base context (this occurs only once), then loads the batch.xml file from /META-INF (if it exists) and the context as defined at jsrJob.xml in /META-INF/batch-jobs. jsrJob.xml can be one of two configurations. It can be a standard Spring context configuration that defines any batch artifacts as Spring Beans and the job via the JSR-352 DSL, or it can be just the job definition as defined by the JSR. Per JSR-352, only one job can be defined within the jsrJob.xml context. The rest of the JsrJobOperator's functionality is virtually a direct wrapping of the existing JobOperator and JobExplorer's functionality (hence their inclusion in the base application context).

Basic Job configuration via XML

JSR-352 defines an XML based DSL that any Spring Batch user will immediately find familiar. Consisting of jobs, steps, readers and writers, most of the concepts that are found in the Spring Batch namespace are accounted for within JSR-352. As part of this release, developers will be able to configure basic jobs using the JSR defined DSL. Basic jobs include the following:

  • <job>
  • <step>
  • <chunk>
  • <batchlet>
  • <reader>
  • <processor>
  • <writer>
  • <decision>
  • <listeners>/<listener>
  • <properties>/<property>
  • <skippable-exception-classes> and related children
  • <retryable-exception-classes> and related children
  • <checkpoint-algorithm>
  • <next>/<end>//<code><fail>

With the JSR, a batch job that looks like this via the Spring Batch DSL:


<job id="data" xmlns="http://www.springframework.org/schema/batch">
    <step id="import" next="report">
        <tasklet>
            <chunk commit-interval="100"
                   reader="itemReader"
                   writer="dataWriter" />
        </tasklet>
    </step>
    <step id="report…
Read more

Spring Security 3.2.0.RC1 Highlights: Security Headers

Engineering | Rob Winch | August 23, 2013 | ...

UPDATE

NOTE This blog post is no longer maintained. Refer to the Headers documentation for up to date information about Spring Security's Headers.

Original Article

This is my last post in a two part series on Spring Security 3.2.0.RC1. My previous post discussed Spring Security's CSRF protection. In this post we will discuss how to use Spring Security to add various response headers to help secure your application.

Security Headers

Many of the new Spring Security features in 3.2.0.RC1 are implemented by adding headers to the response. The foundation for these features came from hard work from Marten Deinum. If the name sounds familiar, it may because one of his 10K+ posts on the Spring Forums has helped you out.

If you are using XML configuration, you can add all of the default headers using Spring Security's element with no child elements to add all the default headers to the response:

<http ...>
    ...
    <headers />
</http>

If you are using Spring Security's Java configuration, all of the default security headers are added by default. They can be disabled using the Java configuration below:

```xml @EnableWebSecurity @Configuration public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override protected void configure(HttpSecurity http) throws Exception { http .headers().disable() ...; } }


<p>The remainder of this post will discuss each of the default headers in more detail:</p>
<ul>
<li><a href="#cache-control">Cache Control</a></li>
<li><a href="#content-type-options">Content Type Options</a></li>
<li><a href="#hsts">HTTP Strict Transport Security</a…
Read more

Spring Security 3.2.0.RC1 Highlights: CSRF Protection

Engineering | Rob Winch | August 21, 2013 | ...

[callout title=Update]

This blog post is no longer maintained. Refer to the CSRF documentation for up to date information about Spring Security and CSRF protection.

[/callout]

On Monday I announced the release of Spring Security 3.2.0.RC1. This is the first of a two part blog series going over the new features found in Spring Security 3.2.0.RC1.

In this first entry, I will go over Spring Security's CSRF support. In the next post, I will go over the various security headers that have been added.

CSRF Attacks

Spring Security has added protection against Cross Site Request Forgery (CSRF) attacks. Great, but what is a CSRF attack and how can Spring Security protect me against it? Let's take a look at a concrete example to get a better…

Read more

Spring Security 3.2.0.RC1 Released (08/2013)

Engineering | Rob Winch | August 19, 2013 | ...

Spring Security 3.2.0.RC1 is now available from the SpringSource repository at http://repo.springsource.org. See here for a quick tutorial on resolving these artifacts via Maven.

This release includes tons of updates and fixes. The highlights include:

  • Polishing of Spring Security Java Configuration
  • Uses content negotiation to determine how to prompt user for authentication when multiple authentication mechanisms (i.e. HTTP Basic and Form login) enabled
  • AbstractSecurityWebApplicationInitializer allows registering Java Configuration directly
  • A number of bugs fixed
  • CSRF protection and automatic integration with Spring Web MVC jsp tags
  • Automatic cache control support
  • Defence against Clickjacking attacks
  • HTTP Strict Transport Security support to reduce Man in the Middle attacks
  • Samples include pom.xml so they can be imported as Maven projects
  • MediaTypeRequestMatcher for matching on requests with content negotiation
  • Over ten java configuration samples have been integrated into the samples directory
  • Three new guides that walk users through samples and provide detailed instructions on how to do specific tasks. More of these guides will follow in coming releases

    • Refer to Spring Security 3.2.0.RC1 preview for more details about this release.

    SpringOne2GX

    To learn about all the new features within Spring Security 3.2 attend my Getting Started with Spring Security 3.2 presentation at SpringOne2GX September 9-12, 2013. If you haven't already gotten your tickets, do so now before its too late!

    Changelog | Download | Reference Manual | Guides | FAQ

    Read more

    This Week in Spring - Aug 13th, 2013

    Engineering | Josh Long | August 14, 2013 | ...

    Welcome back to another installment of This Week in Spring. As usual, we've got a lot to cover, so let's get to it!

    1. The How to do in Java blog has a nice post on how to setup Siteminder pre-authentication using Spring Security 3.
    2. Another great SpringOne2GX 2013 session's just been added to the SpringOne2GX 2013 lineup, Real Time Analytics with Spring. This talk introduces one use case for Project Reactor, a foundation for asynchronous applications on the JVM.
    3. Andy Clement has just cut a new release of AspectJ, 1.8.0.M1, which will be used in Spring 4 and support Java 8. It is available through the SpringSource Maven repository as 1.8.0.M1. It is also in today's release of AJDT for Eclipse 4.3.
    4. The GoPivotal blog has an in-depth look at Apache Tomcat 8. Definitely worth a look!
    5. Eberhard Wolff has put together a very nice video on using the recently announced Spring Boot. Nice job, Eberhard! (as usual)
    6. Our pal Petri Kainulainen has written a very cool post on unit testing Spring MVC REST APIs.
    7. The Being Java Guys blog has a code-heavy post on how to do file uploads with Spring MVC. Nice job!
    8. This post from the Matthew's Thoughts! blog explains a simple Spring REST starter project that demonstrates how to use regular Spring Security to add a username and password-based authentication with a Spring MVC-powered REST service.
    9. The Code with Zen Mind blog has a nice series on building and testing Spring MVC applications. The first post introduces how to setup a test-driven project. The second post demonstrates how to do refactoring and how to introduce new test cases. The third post demonstrates how to use the tests established in the first two posts to survice a major refactoring (the implementation of the service under test changes). Really insightful!
    10. This post from the public static void blog() blog introduces how Spring's logging layering works. The post is in what Google Translate insists is Slovak, however, the translation was pretty good and - if we're honest - the diagrams are quite explanatory by themselves! Good stuff. Take a look, and - if possible - a read.
    11. The 1.5 version of the Cloud Foundry integration for Eclipse, which supports pushing applications to Pivotal Cloud Foundry organizations and spaces, using new Cloud Foundry services, and incrementally updating applications from Spring Tool Suite. The new integration may be installed from the STS dashboard or using the update site in the Help > Install New Software menu.
    Read more

    This Week in Spring - Aug 6th, 2013

    Engineering | Josh Long | August 07, 2013 | ...

    Welcome back to another installment of This Week in Spring. On August 1, I celebrated my third year at SpringSource. I continue to enjoy the ride of my life and a huge part of that is my interaction with you, the most amazing community ever. Thanks for that, folks.

    Have you booked your tickets for SpringOne2GX? This year's show is a special one. In my work as the Spring Developer Advocate, I speak at many conferences all around the world. Ask any developer with a pulse, and they'll confirm that big data (and Hadoop), reactive web applications, REST, mobile application development, and cloud computing are sizzling hot topics today. Pivotal, and Spring, support today's developers, and SpringOne2GX's agenda represents in my estimation the perfect blend of content for today's developers. Check out the agenda. We've just recently added talks on big data, and REST service security with OAuth. This will be our first show under Pivotal, and it's the only place where you can talk to the developers working on the technologies you care about both at SpringSource and in the community. As you know, we've just announced our Cloud Foundry conference, Platform, and SpringOne2GX full pass ticket holders may register for that show - which is at the same venue as SpringOne2GX just two days earlier - for free! If I had to pay for just one show a year, this would be that show. Hurry the early bird rate expires this friday!

    1. Major news: Phil Webb and Dr. David Syer have just announced Spring Boot, which simplifies Spring application development. Spring Boot provides an opinionated layer on top of Spring and in so doing makes it dead simple to get an application up and running with a minimum of fuss. Seriously, this stuff will blow your mind. Do not read any further until you've read this short and sweet post! Give it a go and be sure to let us know about your experiences!
    2. Spring Framework 3.2.4 maintenance release is now available, with an important security fix for SpringOXM..
    3. Spring Data Redis-lead and ninja Jennifer Hickey just announced the availability of two Spring Data releases. Spring Data Redis 1.1, M2, featuring a lot of new features, including enhanced data pipelining, Redis 2.6 scripting, and more. Spring Data Redis 1.0.6 is also available, and features bug fixes and smaller improvements.
    4. Spring Mobile and Android lead Roy Clarkson just announced Spring Mobile 1.1.0.RC1, which features improvements to device detection and view resolution in Spring Mobile. Roy also announced a new cut of the stable line of Spring Mobile, 1.0.2, which features similar improvements, some backported.
    5. Spring Data ninja Oliver Gierke has just announced that the final release candidate for Spring Data Babbage is now available. This release is named for Charles Babbage. This release features support for the MongoDB Aggregation Framework and improved the execution of polymorphic queries, support to use SpEL expressions in manually defined queries with JPA, improved handling of entities using @IdClass, a countBy(..) method for Neo4j repositories, and much more.
    6. The replay for the webinars Functional Programming without Lamba and Spring with Cucumber for Automation are now available online. Be sure to check them out!
    7. A few weeks ago, our friend Johnathan Mark Smith put together a video introducing how to use Spring Data MongoDB and Java configuration. Check it out! And, if you're doing awesome videos, feel free to share. I'd love to post them on This Week in Spring, too!
    8. I smiled when I saw a tweet by the Reactor project lead Jonathan Brisbin in which he says, "Processor throughput: 90M ops/sec on a laptop. 1 thread + @LMAX Disruptor. Not #fastdata, #uberfastdata" and then links to a test case in the code. Needless to say, Reactor is going to shake things up big time! (And, of course, we'll have more content on Reactor at SpringOne2GX.
    9. The latest release of Tomcat, Apache Tomcat 8.0.0-RC1 (alpha), is now available! There are a lot of new features. Notably, Tomcat 8 will be the first Tomcat to support JSR 356, web sockets. This is the perfect compliment to Spring 4's recently announced web socket support.
    10. Mohan Srihari Kantipudi has put together a nice post on Spring's basic REST capabilities
    11. I liked Gregor Riegler's post on Spring Loaded, the best kept secret in open source. Spring Loaded is a Java agent that lets you reload code as you're working on it (no need to redeploy!). This is a very cool post and I hope you'll consider using Spring Loaded, too.
    Read more

    Spring Boot – Simplifying Spring for Everyone

    Engineering | Phil Webb | August 06, 2013 | ...

    (This blog post was written jointly by Phil Webb and Dave Syer).

    We are pleased to announce the first milestone release of a new project called Spring Boot.

    Spring Boot aims to make it easy to create Spring-powered, production-grade applications and services with minimum fuss. It takes an opinionated view of the Spring platform so that new and existing users can quickly get to the bits they need. You can use it to create stand-alone Java applications that can be started using 'java -jar' or more traditional WAR deployments. We also provide a command line tool that runs 'spring scripts'.

    The…

    Read more

    This Week in Spring - July 30, 2013

    Engineering | Josh Long | July 31, 2013 | ...

    Welcome back to another installment of This Week in Spring! As usual, we've got a lot to cover so let's get to it. Don't forget that SpringOne 2GX 2013 early bird expires August 9th, so hurry to secure the discounted rate!

    1. Spring framework committer Rossen Stoyanchev has a great post on Spring Framework 4.0 M2's support for WebSocket Messaging Architectures.
    2. Spring Shell lead Dr. Mark Pollack has announced that Spring Shell 1.0.1.M1 has just been released.
    3. Spring Batch 2.2.1.RELEASE is now available. This release is mostly bug fixes and documentation improvements.
    4. I don't know if you've been following along, but we're starting to really flesh out the SpringOne2GX 2013 schedule! I'm looking forward to both seeing, and presenting, at many different talks this year. One talk I'd like to see is Thymeleaf: improving your Spring view layer with natural templates. I expect this year will be a very exciting year for a number of reasons, and I hope you'll share the experience with us.
    5. We've added some more SpringOne talks recently:
    6. Our pal Tobias Flohre has put together a nice post comparing how the JSR 352 API compares to the Spring Batch. Spring Batch 3.0 will be fully JSR 352 API compliant this fall by SpringOne, but was the inspiration for the JSR in the first place -- Spring Batch 1.0 was released in 2008 and has been gathering steam ever since.
    7. Want to learn more about Spring Scala? Watch Spring Scala lead talk about it at ScalaDays New York.
    8. As I mentioned last week, you'd do well to also follow This Week in Cloud Foundry, which has a lot of great content following last week's large announcement of a partnership between Pivotal and IBM.
    9. The Reactor project lead by John Brisbin has just announced support for a @EnableReactor annotation for Spring Java configuration.
    10. ..Speaking of Thymeleaf (the open source, Spring MVC, HTML5 and Tiles-friendly view and templating engine), version 2.1 will have parameterizable fragments. Do you want to test them? Try the 2.1.0-SNAPSHOT version when specifying your Maven repository-compatible coordinates.
    11. Our friend Johnathan Mark Smith is at it again, this time with a video on using Spring Data MongoDB. Definitely worth a look.
    12. Check out a webinar next month taming coupling & cohesive problems with modularity and Spring with Param Rengaiah.
    Read more

    Get the Spring newsletter

    Stay connected with the Spring newsletter

    Subscribe