Create your first Spring Boot web application with Maven & Thymeleaf: 4 Steps(with Screenshots)

Hello Friends!! If you have ever developed the enterprise spring-based applications then you would surely know the pain for making bulky configuration along with the complicated dependency management. Today we would see how Spring Boot takes this pain away. To demonstrate this, we would discuss step by step process to create our first Spring Boot web application using Spring Tool Suite(STS) and then explain how this has become possible using Spring Boot. Don't worry if haven't developed any spring-based application before because this would be very easy to follow guide.

Table Of Content
1. Introduction
2. Scope
3. Tools & Technology Stack Used
4. Steps to create web application
5. Why Spring Boot?
6. Conclusion

How to configure Maven projects to use a specific JDK version?

Hello friends, today the scope of our discussion would be related to configuring Maven project and  cross-compilation feature of Java. Precisely we would talk about below points:

• the right way of configuring Maven projects to use specific JDK version
• important pointers related to Java compiler & it's cross compilation feature 
• common misconception while configuring the Maven compiler plugin 

Table Of Content

1. Introduction: Maven & JDK
2. Important Pointers
3. Misconception
4. The Right Way: Compiling Projects using a different JDK
5. Conclusion

java.lang.NoClassDefFoundError: javax/transaction/TransactionManager

Recently while trying to migrate one of the application from JDK6 to JDK7 & Spring 3.x to Spring 4.x, I have got Spring  BeanCreationException along with nested exception related to javax TransactionManger while deploying the application in Tomcat 7.

Before sharing the logs, providing the tech stack:
- Maven based application
- Spring 4.x [4.3.0.RELEASE from 3.1.0.RELEASE]
- Tomcat 7.0.83
- JDK 7 [1.7.0_05]

Error Logs:

org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name 'xyz' defined in class path resource [xyz/xyz.xml]: 
Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: 
javax/transaction/TransactionManager 

Solution:

Don't be confused with the BeanCreationException, the issue is happening due to missing jta jar.
Add the below Maven dependency and issue will be resolved:

<dependency>
    <groupId>javax.transaction</groupId>
    <artifactId>jta</artifactId>
    <version>1.1</version>
</dependency>

How to install Maven on Windows: 4 Steps(with Screenshots)

Although Apache Maven could be installed on Windows, Linux, Solaris and Mac OS systems but today we would discuss about how to install Maven on Windows system. Don't worry if you have Unix based system because we would providing some hints, using that one could easily install Maven in their Unix based systems also.

Differences between @RequestParam and @PathVariable annotations in Spring MVC?

Have you came across @RequestParam & @PathVariable annotation used in the Spring MVC framework? If your answer is yes, then do you know exactly when, one should use @RequestParam or @PathVariable annotation because both the annotations are used to extract data from the incoming request. If your answer is no, then you must learn/know about these annotations because it's widely used in both the traditional web application development & RESTful Web Services development using Spring.

Table Of Content

1. Introduction
2. Scope
3. When to use which annotations?
4. Where and How of annotations?
5. Conclusion

How to add delay in your program?

Would like to add delay for a couple of seconds in your program written in Java, then Thread's sleep() method comes to our rescue. It suspends/delays the execution of the current thread for a specified period.

Choose the required method from overloaded version of sleep() method:

public static void sleep(long millis) throws InterruptedException
public static void sleep(long millis, int nanos) throws InterruptedException

Note:

• The sleep time is not guaranteed to be precise, because they are dependent on the facilities provided by the underlying OS.
• Also, the sleep period can be terminated by interrupts. 

Example: Code snippet showing the use of sleep() method 

package com.anshulsblog;

import java.util.Date;

public class TestSleepMethod {

   public static void main(String[] args) throws InterruptedException {

      System.out.println("Time before calling sleep() method: " + new Date());
      Thread.sleep(5000);  //sleep 5 seconds
      System.out.println("Time after calling sleep() method: " + new Date());
   }
}

Output:
Time before calling sleep() method: Tue Dec 12 10:08:17 IST 2017
Time after calling sleep() method: Tue Dec 12 10:08:22 IST 2017

Look at the main() method, it throws InterruptedException. This is an exception thrown by sleep() method when another thread interrupts the current thread while sleep is active. Since this application has not defined another thread to cause the interrupt, it doesn't bother to catch InterruptedException. But one should catch the InterruptedException exception using try catch block.

References:
https://docs.oracle.com/javase/tutorial/essential/concurrency/sleep.html

Identify security vulnerabilities in software components using OWASP Dependency Check maven plugin

In the last post, we have discussed that it's very important to check potential security vulnerabilities in the 3rd party libraries/components we use while development. Today we would discuss, how to find security vulnerabilities in software components using OWASP Dependency Check maven plugin.

Table Of Content

1. Introduction
2. Scope
3. How to use OWASP Dependency Check utility
4. Action Plan for Security Vulnerabilities
5. Conclusion

Secure your applications by checking potential security vulnerabilities in 3rd party libraries

Hello Friends, Let's start our today's discussion with short questionnaire session. [Although here, both the quiz masters & contestants role will be played by me but hey you are free to poke me through comments if I am unfair anywhere  😎]

Q1: As a developer, do you always put a lot of efforts in developing & making your application secure from any security vulnerabilities?
A: Right, we all do. We not only use the coding conventions, standards, design patterns & OOAD principles but also follow various industry and organization specific best practices adhering to the security standards.

QM: Oh That's great to hear! Next question

Q2: Do you use any 3rd party libraries while development or restrict your self from using it?
A:  Of course, we all use 3rd party libraries while development to either reduce development costs or to meets deadlines like Apache Log4j (logging library), Jackson (JASON parser library), Apache Commons Lang, Hibernate ORM etc.
We can't think about development without using 3rd part libraries and why one would not use 3rd party libraries if there are already available open sources libraries for functionalities we are looking for. Why waste our precious time, effort & energy for solutions that already exist? 😉

QM: You are right, it's good to leverage existing solutions but be careful on what 3rd party component are you using.

Q3: Do you check 3rd party libraries for any known, publicly disclosed, potential security vulnerabilities?
A: As we told earlier in Q1, we have developed our application keeping all the necessary best practices related to security in our minds and yes the thought of having potential security vulnerabilities in 3rd party libraries have crossed our mind but we also thought that since the 3rd party libraries that we have used in our application are developed by very known organizational entities and they would be free from security vulnerabilities.
Truly speaking, for some 3rd party libraries, we would wanted to do the through vulnerability analysis but due to hard deadlines, meetings, last minutes requirement changes in project[world famous excuses 😔],  we ended up not doing that analysis.  

QM: Sorry to say, not checking potential security vulnerabilities in 3rd party libraries is a terrible mistake. Let's fire our next question to understand it's importance.

Q4: Are you aware of OWASP Top 10 list ? 
A: [Majority] Never heard about it. [One or two] We have heard the name but not recollecting it properly. what is it exactly?

QM: OWASP stands for The Open Web Application Security Project (OWASP), which is an international, well known, non-profit organization that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. They published "The Top Ten" list aims to raise awareness about application security by identifying some of the most critical risks facing organizations. Among this top 10 list, at number 9, we  have "Top 10 2013-A9-Using Components with Known Vulnerabilities".

Now Think, how important is to analyze the potential security vulnerabilities in 3rd part libraries that they have included this in their Top 10 list because no matter how much effort we all put in securing our application if the 3rd party libraries has any known, publicly disclosed, vulnerabilities then our application is not secured.

Also check out the statistics from the whitepaper "The Unfortunate Reality of Insecure Libraries":

Q5: Are you thinking about how will you check for any known, publicly disclosed, vulnerabilities in the 3rd party libraries?
A: Yes, you are reading our mind. 😊 We assume, there must be any list or database which contains all the information about the known, publicly disclosed, vulnerabilities in 3rd party libraries. We just have to find that list or database and check for vulnerabilities in our used 3rd party libraries.

QM: Great! You all are in the right track.  National Vulnerability Database contains known, publicly disclosed, vulnerabilities in 3rd party libraries. There are also many tools available like OWASP Dependency Check to check the vulnerability in 3rd party libraries.

Disclaimer: This questionnaire compilation is based on the analysis done by me among my friends on the topic "Potential Security Vulnerabilities in 3rd Party Libraries". I know, you might be already doing vulnerability analysis on 3rd part libraries before using them.