8 ms·

Security with Spring

35 points by baeldungcaliah 13y ago

bsaul 13y ago
A bit off topic : I've used Spring some times ago, and it really made me wonder how the full stack would perform on a benchmark against non-JVM frameworks, even though the JVM is faster than anything else. This framework really redefined my notion of bloated, although to be fair, i really don't know if the runtime and API part of the framework gave me that feeling, or if it's not mainly due to the extremely painful development environment (aka spring sts : one JVM for the IDE, one JVM for the bean execution, and one virtualization layer on top of the web server thanks to VMWare vFabric...). In the end, it took me more than 5 minutes to boot STS and get the server run my code, on my fairly recent 4G of RAM MBP.
- deleted 13y ago
  [deleted]
  - jomohke 13y ago
    Out of interest, what stack are you running on? The Spring apps I've worked with in the past (plain Tomcat+Spring) never took more than a few seconds to boot (and most changes could be hot deployed without a restart).
    - fmstephe 13y ago
      Sorry, I just deleted the parent that you replied too. I felt it was too full of emotion and lacked useful content. Currently I am working on Spring+Tomcat. Previously we were working on weblogic + spring, that's where the ~50% CPU time measurement came from. The project where I found myself the most frustrated with Spring was in a simple console app, where Spring became the server container. The application was more or less empty, having only a few database connections, and it took probably about 10 seconds to boot up. I really remember thinking "this is as fast as it will ever be" it only got slower from then on.
- mtrimpe 13y ago
  Spring is just an XML-based DSL that wires objects together and applies AOP aspects to them. Your bad experience was with a Spring-branded Eclipse; the open-source IDE that's so slow and bloated Google preferred switching to a proprietary competitor (IntelliJ) for their latest version of the Android IDE.
  - bsaul 13y ago
    Yes, but I believe sfjailbird is also right (see comment below) : there's also a vicious "enterprise" culture surrounding that technology that really encourages people to keep going in that direction.
    - fmstephe 13y ago
      I think your characterisation of the enterprise culture as vicious isn't too far off the mark. :)
- chris_wot 13y ago
  STS is an IDE, it's not the Spring Framework. Your comparing apples with oranges here...
- brown9-2 13y ago
  You can find some simple benchmarks here: http://www.techempower.com/benchmarks/ http://www.techempower.com/benchmarks/ I would not judge Spring the Framework by Spring the IDE (which is a bunch of plugins on top of Eclipse). The Spring integration in IntelliJ is great.
moondowner 13y ago
@baeldung's posts are really good, especially these regarding Spring Security, and the ones regarding Spring Data stuff. Excellent resource for anyone using Spring.
sfjailbird 13y ago
Spring represents all that is wrong with Java. Its main selling point is that it is not J2EE (shallow praise) yet it retains a lot of the awfulness of J2EE, such as XML just for the sake of it (so now you need heavy tool support just to make sure that classes, methods and fields are referred correctly in the XML files). On top of that it introduces layers of craziness that J2EE could only begin to dream of, such as "aspect oriented" configuration and dynamic proxies that enrich and inject and mutate your objects at runtime such that debugging and tracing becomes completely impossible. Even core Spring concepts like "Inversion of Control" are questionable value propositions that even Martin Fowler has distanced himself from. Java has an ecosystem of enterprise consultants that sell castles in the sky and need to invent complex concepts and technologies to sell themselves and their services. Gullible enterprise developers eat it up and mimmick them. Ignorant CTOs buy their stuff. I'm pissed off about it because Java is basically cool technology but the culture is infected with these bloodsuckers who give it a bad name and do nothing for advancing the state of the language and ecosystem.
- mschulze 13y ago
  How long has it been that you used Spring? You don't need that much XML for a Spring 3.0 application. Almost everything can be done with annotations. Why do you compare Spring with J2EE when in fact JEE took a lot of the good stuff from Spring? The main point of Spring is to help develop consistent applications with enterprise requirements (integration, security, batch jobs, mvc, ...) and it does that incredibly well. Especially integration in a nightmare of systems at a large corporation.
  - bsaul 13y ago
    I do agree that IOC coupled with strong interface definitions and enforcement make a good starting point for building enterprise components in large corporations. Yet, after using Spring for a while, i really wondered how come there couldn't be any simpler solutions to that problem: any compiled language with a good support for interfaces should be able to reach that objective. I think the bloat came from wanting to decouple compilation time from component assembling time, using xml files. I never understood the reason for that choice (who in its right mind would change a component without recompiling for type checking and retesting the code anyway ?). I suppose it probably was the easiest way to accomplish that in Java at some point, and i'm really happy to see that latest Spring versions enable you to use Java configuration classes instead. But as enterprise means long-time support and never ending backward compatibility, i really doubt the bloat culture will fade away any time soon.
commentator 13y ago
If you are new to Spring, then you should start with the current edition of "Spring in Action". It's a good read.

bsaul 13y ago

A bit off topic : I've used Spring some times ago, and it really made me wonder how the full stack would perform on a benchmark against non-JVM frameworks, even though the JVM is faster than anything else. This framework really redefined my notion of bloated, although to be fair, i really don't know if the runtime and API part of the framework gave me that feeling, or if it's not mainly due to the extremely painful development environment (aka spring sts : one JVM for the IDE, one JVM for the bean execution, and one virtualization layer on top of the web server thanks to VMWare vFabric...). In the end, it took me more than 5 minutes to boot STS and get the server run my code, on my fairly recent 4G of RAM MBP.

deleted 13y ago
[deleted]
- jomohke 13y ago
  Out of interest, what stack are you running on? The Spring apps I've worked with in the past (plain Tomcat+Spring) never took more than a few seconds to boot (and most changes could be hot deployed without a restart).
  - fmstephe 13y ago
    Sorry, I just deleted the parent that you replied too. I felt it was too full of emotion and lacked useful content. Currently I am working on Spring+Tomcat. Previously we were working on weblogic + spring, that's where the ~50% CPU time measurement came from. The project where I found myself the most frustrated with Spring was in a simple console app, where Spring became the server container. The application was more or less empty, having only a few database connections, and it took probably about 10 seconds to boot up. I really remember thinking "this is as fast as it will ever be" it only got slower from then on.
mtrimpe 13y ago
Spring is just an XML-based DSL that wires objects together and applies AOP aspects to them. Your bad experience was with a Spring-branded Eclipse; the open-source IDE that's so slow and bloated Google preferred switching to a proprietary competitor (IntelliJ) for their latest version of the Android IDE.
- bsaul 13y ago
  Yes, but I believe sfjailbird is also right (see comment below) : there's also a vicious "enterprise" culture surrounding that technology that really encourages people to keep going in that direction.
  - fmstephe 13y ago
    I think your characterisation of the enterprise culture as vicious isn't too far off the mark. :)
chris_wot 13y ago
STS is an IDE, it's not the Spring Framework. Your comparing apples with oranges here...
brown9-2 13y ago
You can find some simple benchmarks here: http://www.techempower.com/benchmarks/ http://www.techempower.com/benchmarks/ I would not judge Spring the Framework by Spring the IDE (which is a bunch of plugins on top of Eclipse). The Spring integration in IntelliJ is great.

moondowner 13y ago

@baeldung's posts are really good, especially these regarding Spring Security, and the ones regarding Spring Data stuff. Excellent resource for anyone using Spring.

sfjailbird 13y ago

Spring represents all that is wrong with Java. Its main selling point is that it is not J2EE (shallow praise) yet it retains a lot of the awfulness of J2EE, such as XML just for the sake of it (so now you need heavy tool support just to make sure that classes, methods and fields are referred correctly in the XML files). On top of that it introduces layers of craziness that J2EE could only begin to dream of, such as "aspect oriented" configuration and dynamic proxies that enrich and inject and mutate your objects at runtime such that debugging and tracing becomes completely impossible. Even core Spring concepts like "Inversion of Control" are questionable value propositions that even Martin Fowler has distanced himself from. Java has an ecosystem of enterprise consultants that sell castles in the sky and need to invent complex concepts and technologies to sell themselves and their services. Gullible enterprise developers eat it up and mimmick them. Ignorant CTOs buy their stuff. I'm pissed off about it because Java is basically cool technology but the culture is infected with these bloodsuckers who give it a bad name and do nothing for advancing the state of the language and ecosystem.

mschulze 13y ago
How long has it been that you used Spring? You don't need that much XML for a Spring 3.0 application. Almost everything can be done with annotations. Why do you compare Spring with J2EE when in fact JEE took a lot of the good stuff from Spring? The main point of Spring is to help develop consistent applications with enterprise requirements (integration, security, batch jobs, mvc, ...) and it does that incredibly well. Especially integration in a nightmare of systems at a large corporation.
- bsaul 13y ago
  I do agree that IOC coupled with strong interface definitions and enforcement make a good starting point for building enterprise components in large corporations. Yet, after using Spring for a while, i really wondered how come there couldn't be any simpler solutions to that problem: any compiled language with a good support for interfaces should be able to reach that objective. I think the bloat came from wanting to decouple compilation time from component assembling time, using xml files. I never understood the reason for that choice (who in its right mind would change a component without recompiling for type checking and retesting the code anyway ?). I suppose it probably was the easiest way to accomplish that in Java at some point, and i'm really happy to see that latest Spring versions enable you to use Java configuration classes instead. But as enterprise means long-time support and never ending backward compatibility, i really doubt the bloat culture will fade away any time soon.

commentator 13y ago

If you are new to Spring, then you should start with the current edition of "Spring in Action". It's a good read.