Spring / Spring7 Intermediate to Advanced Interview questions
1. What is the difference between Spring Framework 6 and Spring Framework 7?
Spring 6 and Spring 7 are both generational releases, but 7 builds a further layer of change on top of what 6 already introduced. Aspect Spring 6 Spring 7 Jakarta EE EE 9, later EE 10 EE 11 (Servlet 6.1,...
2. How does Spring Boot 4 differ from Spring Boot 3 in terms of baseline requirements?
Spring Boot 4 sits on Spring Framework 7, so its baseline shift mirrors the framework's own jump. Requirement Spring Boot 3 Spring Boot 4 Underlying framework Spring Framework 6 Spring Framework 7 Jakarta EE EE 9/10 EE 11 Servlet container...
3. Which is better and why: upgrading directly from Spring Boot 2 to Spring Boot 4, or upgrading incrementally through Spring Boot 3?
An incremental upgrade - Boot 2 to Boot 3, then Boot 3 to Boot 4 - is almost always the safer choice for anything beyond a small application, even though it takes two migration cycles instead of one. Going step...
4. Why did Spring Framework 7 move from Jakarta EE 10 to Jakarta EE 11?
Jakarta EE 10 was the baseline Spring 6 introduced back in 2022, and the Jakarta EE community has continued advancing the underlying specifications since then - Servlet 6.1, WebSocket 2.2, Bean Validation 3.1, and JPA 3.2 all carry refinements that...
5. What happens when a Spring Boot 3 / Spring 6 application is upgraded to Spring Boot 4 / Spring 7 without addressing RestTemplate and other deprecations?
The application still compiles and runs - RestTemplate and similar APIs are deprecated, not removed, in Spring Framework 7.1, so nothing breaks immediately. What changes is the risk profile going forward....
6. What is the difference between Spring Security 6 and Spring Security 7?
Spring Security 7 (paired with Spring Framework 7) makes several changes that go beyond a routine dependency bump. Aspect Spring Security 6 Spring Security 7 Multi-factor auth No first-class support Native MFA authorization managers OAuth2 password grant Present, discouraged Removed...
7. How does multi-factor authentication (MFA) work natively in Spring Security 7?
Spring Security 7 models each completed authentication factor as an authority granted to the Authentication object, and provides authorization managers that check for a required combination of those factor authorities before granting access. http.authorizeHttpRequests(auth -> auth .requestMatcher
8. Why was the OAuth2 password grant removed in Spring Security 7?
The Resource Owner Password Credentials grant requires the client application to collect a user's raw username and password directly and forward them to the authorization server, rather than redirecting the user to authenticate on the identity provider's own page. That...
9. How does Spring Security 7 improve OAuth2 client support for HTTP service clients like RestClient?
Spring Security 7 adds OAuth2 support directly into the builders for HTTP service clients, so an outbound call to a protected downstream API can have a bearer token attached automatically instead of the application manually managing token acquisition and refresh...
10. When should you choose PKCE over the classic authorization code flow in Spring Security 7's Authorization Server?
PKCE (Proof Key for Code Exchange) adds a client-generated code_verifier / code_challenge pair to the authorization code flow, so that even if an attacker intercepts the authorization code, they can't exchange it for a token without also having the original...
11. Explain the execution flow of a request through the Spring Security filter chain?
Every request to a secured application first passes through a single servlet Filter , FilterChainProxy , which delegates to an ordered list of security filters matched to that request's SecurityFilterChain . flowchart LR A[Request] --> B[FilterChainProxy] B --> C[SecurityContextHolderFilter] C...
12. How do you prevent duplicate form submissions caused by double-clicking a submit button in a Spring MVC application?
No single technique fully solves this on its own, so a layered approach works best. Client-side, disabling the submit button in the click handler stops most accidental double-clicks, but it's not reliable on its own since JavaScript can be disabled,...
13. How would you implement idempotency-key based duplicate request detection in a Spring REST API?
The client generates a unique key - typically a UUID - once per logical action, and sends it as a header (for example, Idempotency-Key ) on the request, reusing the same key if it needs to retry. @Component public class...
14. Why is the Post/Redirect/Get pattern not sufficient on its own to prevent double-click duplicate submissions?
Post/Redirect/Get solves a specific, later problem: it stops a browser from re-issuing the original POST when the user refreshes the page or clicks back after the first submission already completed and redirected. Because the address bar now shows a GET...
15. Why doesn't @Transactional work when called from within the same class (self-invocation)?
Spring's default @Transactional support is implemented with AOP proxies - a JDK dynamic proxy if the target implements an interface, or a CGLIB-generated subclass otherwise. The transactional behavior (starting, committing, rolling back) is advice woven in at the proxy layer,...
16. How does Spring resolve circular dependencies between singleton beans?
For singleton beans wired via setter or field injection, Spring can resolve a circular reference using a three-level cache during bean creation: singletonObjects (fully created beans), earlySingletonObjects (early references already exposed), and singletonFactories (factories that can produce an
17. Explain the internal working of the DispatcherServlet request-handling flow in Spring MVC?
DispatcherServlet coordinates a well-defined internal pipeline for every request, delegating to a series of collaborator components rather than handling anything itself. sequenceDiagram participant C as Client participant DS as DispatcherServlet participant HM as HandlerMapping participant HA as
18. Explain the internal working of Spring AOP proxy creation?
Spring AOP proxies are created lazily, at bean-instantiation time, by a BeanPostProcessor - specifically a subclass of AbstractAutoProxyCreator - that inspects each new bean against the registered aspects' pointcuts to decide whether it needs advising at all. flowchart TD A[Bean...
19. How is a GraalVM native image build different from a traditional JAR deployment in Spring Boot 4?
A traditional JAR deployment ships portable bytecode that runs on any matching JVM: the JVM interprets and JIT-compiles code as it runs, resolves reflection and dynamic proxies at runtime, and pays a warm-up cost (several seconds of startup, growing memory...
20. When should you choose WebFlux over Spring MVC in a Spring Framework 7 application?
WebFlux earns its complexity when an application is genuinely I/O-bound at high concurrency with a reactive-native downstream stack - for example, a gateway service fanning out to dozens of other services concurrently, a service using R2DBC or reactive MongoDB drivers...
21. How do you troubleshoot a bean that fails to initialize due to a circular dependency?
The first step is reading the BeanCurrentlyInCreationException stack trace carefully - Spring lists the full cycle of bean names it detected, which immediately tells you which beans are involved and, from their constructors, whether the cycle runs through constructor injection...
22. What happens when two beans of the same type exist without a @Primary or @Qualifier?
Spring fails fast at context startup with a NoUniqueBeanDefinitionException , listing the names of every candidate bean it found matching the requested type, rather than guessing which one the application meant. NoUniqueBeanDefinitionException: expected single matching bean but found 2: stripeGat
23. How can you optimize Spring Boot 4 application startup time?
Several complementary techniques target different parts of the startup cost. Lazy initialization ( spring.main.lazy-initialization=true ) defers bean creation until first use rather than eagerly building the entire context up front, though it trades some request-time latency for faster boot.
24. Why should you avoid field injection in production Spring codebases?
Field injection hides a class's real dependencies from anyone reading its public API - the constructor signature says nothing about what the class actually needs, so understanding its requirements means scanning every field for @Autowired annotations instead of reading one...
25. How is the API version resolved when a client sends no version header in Spring Framework 7?
The outcome depends on how the application configured its ApiVersionStrategy . If a default version is set via ApiVersionConfigurer.setDefaultVersion() , an unversioned request is treated as if it had requested that default, and gets routed accordingly - this is the...
26. Which is better and why: RestClient or WebClient for a blocking Spring MVC service?
RestClient is the better fit for a classic, blocking Spring MVC application. It's purpose-built for synchronous use - a call to .retrieve().body(Product.class) returns the object directly, with no Mono / Flux wrapping or .block() calls needed - which matches how...
27. How does Spring Framework 7 take advantage of virtual threads compared to the traditional platform-thread model?
A traditional Spring MVC deployment runs each request on a thread drawn from a bounded platform-thread pool - Tomcat's default is around 200 threads. Every blocking call a request makes (a JDBC query, a downstream HTTP call) ties up one...
28. Why doesn't a @Scheduled method run concurrently with itself by default in Spring?
Spring's default scheduling infrastructure behind @EnableScheduling uses a single-threaded TaskScheduler unless the application explicitly supplies its own multi-threaded one. With only one thread servicing every @Scheduled method, if a given execution takes longer than the method's fixed interva
29. How do you troubleshoot a NoSuchBeanDefinitionException in a Spring application?
The exception means Spring searched the context for a bean of the requested type (or name) and found none, so troubleshooting is really a process of figuring out why the bean never got registered. Check that the class actually carries...
30. Explain the lifecycle of a request handled through an HTTP Interface client (@HttpExchange) in Spring 7?
An HTTP Interface client is a plain interface annotated with @HttpExchange -family annotations; at startup, HttpServiceProxyFactory generates a JDK dynamic proxy implementing that interface, so the application never writes an implementation by hand. sequenceDiagram participant App as Application
31. What is the difference between @ControllerAdvice and a Filter for handling errors in Spring MVC?
@ControllerAdvice paired with @ExceptionHandler operates inside the Spring MVC dispatch layer - it only catches exceptions thrown after HandlerMapping has already matched a controller and the request is being processed by, or on the way into, that controller's code (including...
32. Why is JSpecify considered a breaking change for some Kotlin Spring projects upgrading to Spring Framework 7?
Kotlin's compiler enforces null-safety at compile time, and it does so for Spring's own APIs by reading whichever nullability annotations Spring's method signatures carry - previously Spring's own org.springframework.lang.Nullable / NonNull annotations, now JSpecify's @Nullable / @NonNull in Spri
33. How do you optimize a Spring Data JPA application to avoid the N+1 query problem?
The N+1 problem shows up when loading a list of parent entities triggers one query for the list, then a separate lazy-loading query for each row's related association - a hundred orders each lazily fetching their line items means a...
34. When would you choose NESTED over REQUIRES_NEW transaction propagation?
Choose NESTED when an inner operation should be able to fail and roll back on its own, without ending or suspending the outer transaction around it - useful for something like a batch import where one bad record should be...
35. How does Micrometer observability integrate with Spring Framework 7's tracing support?
Spring Framework 7's own instrumentation - HTTP client and server calls, @Scheduled executions, messaging listeners - emits Micrometer Observation s through a shared ObservationRegistry rather than each subsystem hand-rolling its own metrics or trace spans separately. flowchart LR A[Instrumented
36. Why is @Order important when multiple Filters or HandlerInterceptors are registered in a Spring application?
Filters and interceptors frequently depend on state or side effects a previous one is expected to have already set up, so the sequence they run in isn't cosmetic - it's part of the application's correctness. @Bean public FilterRegistrationBean < RequestLoggingFilter...
37. How does Spring Framework 7's BeanRegistrar differ from a traditional @Configuration class with multiple @Bean methods?
A @Configuration class with several @Bean methods is fundamentally declarative: each method runs and produces exactly one bean, unconditionally, unless individually decorated with @Conditional -family annotations - registering a variable number of beans, or beans whose type or name depends...
38. What is the difference between @RequestMapping's version attribute and content negotiation via the Accept header for API evolution?
The version attribute is a dedicated mechanism built specifically for API lifecycle evolution: it's declared once per handler method, resolved consistently through a configurable, application-wide strategy (header, path segment, query parameter, or media type), understood natively by client-side
39. How do you troubleshoot slow Spring Boot 4 native image builds?
Native image build time is dominated by GraalVM's whole-program reachability analysis, so troubleshooting mostly means finding what's making that analysis larger or slower than it needs to be. Check the memory allocated to the native-image build tool itself - it's...
40. Why do many teams delay adopting GraalVM native images despite the startup-time benefits in Spring Boot 4?
The benefits are real but narrow, while the costs land on every build, for every developer, regardless of whether the deployment shape actually needs them. Build times for a native image are dramatically longer than a standard JAR build -...
