Spring / Spring7 Intermediate to Advanced Interview questions
1. What is the difference between Spring Framework 6 and Spring Framework 7?
Spring 6 and Spring 7 are both generational releases, but 7 builds a further layer of change on top of what 6 already introduced. Aspect Spring 6 Spring 7 Jakarta EE EE 9, later EE 10 EE 11 (Servlet 6.1, JPA 3.2) Java baseline 17 (recommended up to 21) 17 (recommended up to 25) API versioning No ...
2. How does Spring Boot 4 differ from Spring Boot 3 in terms of baseline requirements?
Spring Boot 4 sits on Spring Framework 7, so its baseline shift mirrors the framework's own jump. Requirement Spring Boot 3 Spring Boot 4 Underlying framework Spring Framework 6 Spring Framework 7 Jakarta EE EE 9/10 EE 11 Servlet container Tomcat 10, Jetty 11 Tomcat 11+, Jetty 12.1+ Minimum Java ...
3. Which is better and why: upgrading directly from Spring Boot 2 to Spring Boot 4, or upgrading incrementally through Spring Boot 3?
An incremental upgrade - Boot 2 to Boot 3, then Boot 3 to Boot 4 - is almost always the safer choice for anything beyond a small application, even though it takes two migration cycles instead of one. Going step by step means each hop only has to absorb one generation's worth of breaking changes (...
4. Why did Spring Framework 7 move from Jakarta EE 10 to Jakarta EE 11?
Jakarta EE 10 was the baseline Spring 6 introduced back in 2022, and the Jakarta EE community has continued advancing the underlying specifications since then - Servlet 6.1, WebSocket 2.2, Bean Validation 3.1, and JPA 3.2 all carry refinements that Servlet 6.0 and its 2022-era siblings didn't hav...
5. What happens when a Spring Boot 3 / Spring 6 application is upgraded to Spring Boot 4 / Spring 7 without addressing RestTemplate and other deprecations?
The application still compiles and runs - RestTemplate and similar APIs are deprecated, not removed, in Spring Framework 7.1, so nothing breaks immediately. What changes is the risk profile going forward. // still works after upgrading, but now emits a deprecation warning RestTemplate restTemplat...
6. What is the difference between Spring Security 6 and Spring Security 7?
Spring Security 7 (paired with Spring Framework 7) makes several changes that go beyond a routine dependency bump. Aspect Spring Security 6 Spring Security 7 Multi-factor auth No first-class support Native MFA authorization managers OAuth2 password grant Present, discouraged Removed entirely PKCE...
7. How does multi-factor authentication (MFA) work natively in Spring Security 7?
Spring Security 7 models each completed authentication factor as an authority granted to the Authentication object, and provides authorization managers that check for a required combination of those factor authorities before granting access. http.authorizeHttpRequests(auth -> auth .requestMatcher...
8. Why was the OAuth2 password grant removed in Spring Security 7?
The Resource Owner Password Credentials grant requires the client application to collect a user's raw username and password directly and forward them to the authorization server, rather than redirecting the user to authenticate on the identity provider's own page. That design has been flagged as ...
9. How does Spring Security 7 improve OAuth2 client support for HTTP service clients like RestClient?
Spring Security 7 adds OAuth2 support directly into the builders for HTTP service clients, so an outbound call to a protected downstream API can have a bearer token attached automatically instead of the application manually managing token acquisition and refresh in an interceptor. @Bean @ClientRe...
10. When should you choose PKCE over the classic authorization code flow in Spring Security 7's Authorization Server?
PKCE (Proof Key for Code Exchange) adds a client-generated code_verifier / code_challenge pair to the authorization code flow, so that even if an attacker intercepts the authorization code, they can't exchange it for a token without also having the original verifier the client held onto locally. ...
11. Explain the execution flow of a request through the Spring Security filter chain?
Every request to a secured application first passes through a single servlet Filter , FilterChainProxy , which delegates to an ordered list of security filters matched to that request's SecurityFilterChain . flowchart LR A[Request] --> B[FilterChainProxy] B --> C[SecurityContextHolderFilter] C --...
12. How do you prevent duplicate form submissions caused by double-clicking a submit button in a Spring MVC application?
No single technique fully solves this on its own, so a layered approach works best. Client-side, disabling the submit button in the click handler stops most accidental double-clicks, but it's not reliable on its own since JavaScript can be disabled, slow, or bypassed by a fast enough second click...
13. How would you implement idempotency-key based duplicate request detection in a Spring REST API?
The client generates a unique key - typically a UUID - once per logical action, and sends it as a header (for example, Idempotency-Key ) on the request, reusing the same key if it needs to retry. @Component public class IdempotencyInterceptor implements HandlerInterceptor { private final StringRe...
14. Why is the Post/Redirect/Get pattern not sufficient on its own to prevent double-click duplicate submissions?
Post/Redirect/Get solves a specific, later problem: it stops a browser from re-issuing the original POST when the user refreshes the page or clicks back after the first submission already completed and redirected. Because the address bar now shows a GET URL, a refresh just re-fetches that GET, no...
15. Why doesn't @Transactional work when called from within the same class (self-invocation)?
Spring's default @Transactional support is implemented with AOP proxies - a JDK dynamic proxy if the target implements an interface, or a CGLIB-generated subclass otherwise. The transactional behavior (starting, committing, rolling back) is advice woven in at the proxy layer, not inside the targe...
16. How does Spring resolve circular dependencies between singleton beans?
For singleton beans wired via setter or field injection, Spring can resolve a circular reference using a three-level cache during bean creation: singletonObjects (fully created beans), earlySingletonObjects (early references already exposed), and singletonFactories (factories that can produce an ...
17. Explain the internal working of the DispatcherServlet request-handling flow in Spring MVC?
DispatcherServlet coordinates a well-defined internal pipeline for every request, delegating to a series of collaborator components rather than handling anything itself. sequenceDiagram participant C as Client participant DS as DispatcherServlet participant HM as HandlerMapping participant HA as ...
18. Explain the internal working of Spring AOP proxy creation?
Spring AOP proxies are created lazily, at bean-instantiation time, by a BeanPostProcessor - specifically a subclass of AbstractAutoProxyCreator - that inspects each new bean against the registered aspects' pointcuts to decide whether it needs advising at all. flowchart TD A[Bean instantiated] -->...
19. How is a GraalVM native image build different from a traditional JAR deployment in Spring Boot 4?
A traditional JAR deployment ships portable bytecode that runs on any matching JVM: the JVM interprets and JIT-compiles code as it runs, resolves reflection and dynamic proxies at runtime, and pays a warm-up cost (several seconds of startup, growing memory as the JIT optimizes hot paths) in excha...
20. When should you choose WebFlux over Spring MVC in a Spring Framework 7 application?
WebFlux earns its complexity when an application is genuinely I/O-bound at high concurrency with a reactive-native downstream stack - for example, a gateway service fanning out to dozens of other services concurrently, a service using R2DBC or reactive MongoDB drivers end to end, or one serving l...
21. How do you troubleshoot a bean that fails to initialize due to a circular dependency?
The first step is reading the BeanCurrentlyInCreationException stack trace carefully - Spring lists the full cycle of bean names it detected, which immediately tells you which beans are involved and, from their constructors, whether the cycle runs through constructor injection (unresolvable autom...
22. What happens when two beans of the same type exist without a @Primary or @Qualifier?
Spring fails fast at context startup with a NoUniqueBeanDefinitionException , listing the names of every candidate bean it found matching the requested type, rather than guessing which one the application meant. NoUniqueBeanDefinitionException: expected single matching bean but found 2: stripeGat...
23. How can you optimize Spring Boot 4 application startup time?
Several complementary techniques target different parts of the startup cost. Lazy initialization ( spring.main.lazy-initialization=true ) defers bean creation until first use rather than eagerly building the entire context up front, though it trades some request-time latency for faster boot. Trim...
24. Why should you avoid field injection in production Spring codebases?
Field injection hides a class's real dependencies from anyone reading its public API - the constructor signature says nothing about what the class actually needs, so understanding its requirements means scanning every field for @Autowired annotations instead of reading one method signature. // fi...
25. How is the API version resolved when a client sends no version header in Spring Framework 7?
The outcome depends on how the application configured its ApiVersionStrategy . If a default version is set via ApiVersionConfigurer.setDefaultVersion(...) , an unversioned request is treated as if it had requested that default, and gets routed accordingly - this is the common choice for keeping o...
26. Which is better and why: RestClient or WebClient for a blocking Spring MVC service?
RestClient is the better fit for a classic, blocking Spring MVC application. It's purpose-built for synchronous use - a call to .retrieve().body(Product.class) returns the object directly, with no Mono / Flux wrapping or .block() calls needed - which matches how an MVC controller thread already o...
27. How does Spring Framework 7 take advantage of virtual threads compared to the traditional platform-thread model?
A traditional Spring MVC deployment runs each request on a thread drawn from a bounded platform-thread pool - Tomcat's default is around 200 threads. Every blocking call a request makes (a JDBC query, a downstream HTTP call) ties up one of those full OS threads for the entire wait, so total concu...
28. Why doesn't a @Scheduled method run concurrently with itself by default in Spring?
Spring's default scheduling infrastructure behind @EnableScheduling uses a single-threaded TaskScheduler unless the application explicitly supplies its own multi-threaded one. With only one thread servicing every @Scheduled method, if a given execution takes longer than the method's fixed interva...
29. How do you troubleshoot a NoSuchBeanDefinitionException in a Spring application?
The exception means Spring searched the context for a bean of the requested type (or name) and found none, so troubleshooting is really a process of figuring out why the bean never got registered. Check that the class actually carries a stereotype annotation ( @Component , @Service , etc.) or is ...
30. Explain the lifecycle of a request handled through an HTTP Interface client (@HttpExchange) in Spring 7?
An HTTP Interface client is a plain interface annotated with @HttpExchange -family annotations; at startup, HttpServiceProxyFactory generates a JDK dynamic proxy implementing that interface, so the application never writes an implementation by hand. sequenceDiagram participant App as Application ...
31. What is the difference between @ControllerAdvice and a Filter for handling errors in Spring MVC?
@ControllerAdvice paired with @ExceptionHandler operates inside the Spring MVC dispatch layer - it only catches exceptions thrown after HandlerMapping has already matched a controller and the request is being processed by, or on the way into, that controller's code (including argument resolution ...
32. Why is JSpecify considered a breaking change for some Kotlin Spring projects upgrading to Spring Framework 7?
Kotlin's compiler enforces null-safety at compile time, and it does so for Spring's own APIs by reading whichever nullability annotations Spring's method signatures carry - previously Spring's own org.springframework.lang.Nullable / NonNull annotations, now JSpecify's @Nullable / @NonNull in Spri...
33. How do you optimize a Spring Data JPA application to avoid the N+1 query problem?
The N+1 problem shows up when loading a list of parent entities triggers one query for the list, then a separate lazy-loading query for each row's related association - a hundred orders each lazily fetching their line items means a hundred and one round trips to the database instead of two. @Quer...
34. When would you choose NESTED over REQUIRES_NEW transaction propagation?
Choose NESTED when an inner operation should be able to fail and roll back on its own, without ending or suspending the outer transaction around it - useful for something like a batch import where one bad record should be skipped without discarding everything already processed successfully. @Tran...
35. How does Micrometer observability integrate with Spring Framework 7's tracing support?
Spring Framework 7's own instrumentation - HTTP client and server calls, @Scheduled executions, messaging listeners - emits Micrometer Observation s through a shared ObservationRegistry rather than each subsystem hand-rolling its own metrics or trace spans separately. flowchart LR A[Instrumented ...
36. Why is @Order important when multiple Filters or HandlerInterceptors are registered in a Spring application?
Filters and interceptors frequently depend on state or side effects a previous one is expected to have already set up, so the sequence they run in isn't cosmetic - it's part of the application's correctness. @Bean public FilterRegistrationBean < RequestLoggingFilter > loggingFilter() { FilterRegi...
37. How does Spring Framework 7's BeanRegistrar differ from a traditional @Configuration class with multiple @Bean methods?
A @Configuration class with several @Bean methods is fundamentally declarative: each method runs and produces exactly one bean, unconditionally, unless individually decorated with @Conditional -family annotations - registering a variable number of beans, or beans whose type or name depends on run...
38. What is the difference between @RequestMapping's version attribute and content negotiation via the Accept header for API evolution?
The version attribute is a dedicated mechanism built specifically for API lifecycle evolution: it's declared once per handler method, resolved consistently through a configurable, application-wide strategy (header, path segment, query parameter, or media type), understood natively by client-side ...
39. How do you troubleshoot slow Spring Boot 4 native image builds?
Native image build time is dominated by GraalVM's whole-program reachability analysis, so troubleshooting mostly means finding what's making that analysis larger or slower than it needs to be. Check the memory allocated to the native-image build tool itself - it's a memory-hungry AOT compiler dis...
40. Why do many teams delay adopting GraalVM native images despite the startup-time benefits in Spring Boot 4?
The benefits are real but narrow, while the costs land on every build, for every developer, regardless of whether the deployment shape actually needs them. Build times for a native image are dramatically longer than a standard JAR build - what's a few seconds with a normal Maven/Gradle build can ...
