Detailed training program
- Positioning the course, its boundaries within the track, and kicking off the end-to-end Task Tracker API project
- HTTP through the eyes of a backend developer, not just as "methods and status codes from theory"
- REST as a practical API design style, not a set of dogmatic rules
- URIs, resource boundaries, and the final endpoint map of the project
- Spring MVC request handling without the magic and without diving early into framework internals
- Sources of input data in a controller: path, query, headers, and a criteria DTO
- Request body, response body, and correct HTTP responses for create/update/delete operations
- HttpMessageConverter and the real mechanics of body conversion in Spring MVC
- Project architecture within the REST course: controllers, services, in-memory repositories, and a storage abstraction
- DTOs as protection for the external contract and as a way to avoid leaking your internal model
- Jackson 3 and JSON basics for the course's chosen Boot line
- The Jackson annotations you actually need in a REST course, and where to stop
- JSON beyond simple DTOs: generics, tree model, and partially dynamic input without descending into chaos
- Stable response shapes, list envelopes, and safe evolution of the JSON contract
- Basic input validation with Bean Validation and the Spring Boot validation stack
- Validating nested structures, collections, and request parameters
- Custom validation, cross-field rules, and the line between input validation and business validation
- How to return validation errors so they're useful to the client without breaking a single error contract
- Categories of API errors and the modern baseline approach via ProblemDetail
- @ControllerAdvice, @ExceptionHandler, and translating exceptions into unified HTTP responses
- Designing a good error response: codes, details, field errors, and conflicting business scenarios
- Collection endpoints, pagination, and sorting without relying on Spring Data abstractions
- Filtering and search without turning your API into a chaotic pile of query parameters
- Creating, updating, and deleting resources: POST, PUT, PATCH, DELETE without unnecessary confusion
- Non-CRUD scenarios, state transitions, and supporting sub-resources without RPC chaos
- File upload in Spring MVC and multipart/form-data as part of a normal applied API
- Download endpoints, local file storage, and separating metadata from content
- Externalized configuration in the context of the REST course and the project's applied scenarios
- API evolution and OpenAPI documentation as a continuation of the contract-first approach
- @WebMvcTest, MockMvc, and the final assembly of the production-like REST API skill
- Why an application needs a persistence layer, and how JDBC, JPA, Hibernate, and Spring Data JPA relate
- SQL refresher — tables, keys, constraints, and joins as the backdrop for entity mapping
- SQL refresher for write scenarios — DML, indexes, and transactional logic before @Transactional
- Spinning up PostgreSQL, configuring the DataSource and HikariCP, and scaffolding the shop-data-jpa project
- Your first entity, the primary key, and basic field mapping
- Entity design — states, @Embeddable, value objects, and the model's boundaries
- The repository abstraction — how an interface becomes a component and where the repository's responsibility ends
- ManyToOne, OneToMany, the owning side, and a mental model of relationships in JPA
- OneToOne, controlled ManyToMany, and the first fetch traps worth seeing early
- Derived queries, sorting, Page, and Slice for typical REST and service scenarios
- JPQL and @Query as the next step, when method names stop being convenient
- Projections as a normal read-side tool, not a rare exotic feature
- Native queries — only where JPQL is already awkward, without turning the course into an SQL-first story
- @Modifying, bulk update/delete, and the difference between "change entities" and "change data fast"
- Pragmatic Specification for dynamic filtering and a controlled preview of more flexible querying
- The modern repository API, legacy patterns from old articles, and finalizing the querying block
- Why @Transactional is a business-operation boundary, not a decorative annotation
- Designing placeOrder() as a full-fledged unit of work, not a set of repository calls
- The depth you actually need on propagation, isolation, and transactional defaults at the Junior level
- Persistence context, dirty checking, flush, and detached objects — what feels like "Hibernate magic"
- Lazy loading, LazyInitializationException, and N+1 as the first real pain of ORM
- join fetch, @EntityGraph, and projections for deliberate control over how data is read
- Flyway and the life of a DB schema — from a demo schema to a reproducible data layer
- DB constraints, exception translation, and the line between code-level validation and data protection
- Concurrent access, lost update, and optimistic locking as the basis for a multi-user application
- Auditing, shared fields, and a maintainable data layer without excess architectural weight
- @DataJpaTest, repository tests, and verifying mappings, queries, and pagination on an isolated data layer
- Transactional service tests, H2 traps, an optional Testcontainers preview, and the final assembly of the data layer
- Why Spring Security appears in a Spring Boot application and what problems it solves
- What changes in the application right after adding spring-boot-starter-security
- The request lifecycle and the anatomy of the filter chain in a servlet application
- Authentication internals without the magic and without unnecessary low-level overload
- Your first meaningful SecurityFilterChain and your first custom access rules
- Passwords, the PasswordEncoder, and a secure model for storing credentials
- In-memory users, roles, and authorities as a first working security model
- Form login as the best learning bridge to understanding Spring Security
- Session-based security as a full-fledged model, not "the outdated way before JWT"
- HTTP Basic and API clients as a simple, honest comparison baseline
- CSRF fundamentals on real state-changing requests
- CORS, cookies, and frontend integration without the myths and blind disabling
- Multipart and file upload security through the example of a user avatar
- Moving from in-memory authentication to DB-backed users
- CustomUserDetailsService and DaoAuthenticationProvider on top of the database
- User registration and the account lifecycle
- REST-friendly security errors and the difference between 401 and 403
- Request-level authorization for the REST API and supporting endpoints
- Method security as a separate layer of protection, not an add-on to URL rules
- Ownership-based access, the current user, and "mine vs. not mine" rules
- From stateful security to a stateless API without the ideological war
- JWT basics without the marketing fog and unnecessary OAuth2 context
- Issuing JWTs and designing the login endpoint for a stateless API
- A custom JWT filter as the most transparent way to understand stateless authentication
- Built-in Bearer/JWT support as an alternative, more framework-native implementation
- MockMvc and a baseline set of security tests for a Spring MVC application
- Testing CSRF, form login, JWT, and negative security scenarios
- Hardening, troubleshooting, and the project's final security audit
430+
Lessons
800+
Tasks
86
Tests
And also:
- Instant validation
- AI code validator
- IDE plugin
- WebIDE
- Gamification