I. How to enable asynchronous in Spring Boot

III. Asynchronous processing with return values

Have you ever accidentally committed an application.properties file containing a database password, API key, or other sensitive information to Git? This is one of the most common and dangerous security risks developers face.

"Hardcoding" (writing these sensitive values directly) in your code or configuration files is a bad practice. Fortunately, Spring Boot provides an excellent mechanism to integrate with Secret Manager systems, helping you store and retrieve this information securely.

What is a Secret Manager?

A Secret Manager is a specialized service (usually provided by cloud platforms) designed to store, manage, and control access to sensitive information like passwords, API keys, certificates, and other secrets used by applications. Instead of hardcoding these values in your code or configuration files, Secret Manager allows you to keep them in a secure, centralized place.

We will start with AWS Secret Manager to store the username and password for the database.

Step 1: Create a Secret on AWS

The best way to store multiple related values (like a database username and password) is to use the JSON format.

• Access the AWS Management Console > Secrets Manager.
• Click on "Store a new secret".
• In the "Key/value pairs" section, enter your values as JSON. This is a very effective method.
• Example: to store database information, you can configure it as follows:

Give the secret a name (e.g., production/database/credentials).
Tip: Use a hierarchical prefix (like production/ or my-app/) for easy management and permissions.

• Click Next > Next and finally "Store".

Step 2: Configure Permissions (IAM)

Your Spring Boot application needs permission to read this secret.

On Production (EC2, ECS, EKS): You should create an IAM Role (e.g., MyWebAppRole), assign this Role to your service (e.g., assign it to the EC2 instance). Then, create a Policy to grant permissions to that Role.

Step 3: Update pom.xml (Spring Boot 3.x)

Add the Spring Cloud AWS BOM (Bill of Materials) to <dependencyManagement>:

Step 4: Configure Spring Boot to "Import" Secrets

Conclusion

You have successfully configured your Spring Boot application to dynamically read secrets from AWS Secrets Manager. This method is not only more secure but also much more flexible. When you need to rotate a password, you just need to update the value in AWS Secrets Manager; your application will automatically pick up the new value on its next startup without needing to rebuild or redeploy the code.

Whether you need scalable software solutions, expert IT outsourcing, or a long-term development partner, ISB Vietnam is here to deliver. Let’s build something great together—reach out to us today. Or click here to explore more ISB Vietnam's case studies.

[References]

• https://www.freepik.com/free-vector/futuristic-cyber-security-background_8015396.htm#fromView=search&page=1&position=23&uuid=6aa83cbc-669a-4301-919c-b536f850b5e2&query=security (Image link).
• https://www.baeldung.com/spring-boot-integrate-aws-secrets-manager
• https://docs.awspring.io/spring-cloud-aws/docs/current/reference/html/index.html#secrets-manager

As Object-Oriented Programming (OOP) developers, we are trained to build systems by encapsulating data and behavior into Objects. But there's a problem OOP doesn't solve cleanly.

Imagine you have 100 different service methods. In almost every single one, you find yourself writing the same boilerplate code:

1. Log "Starting method..."
2. Check user permissions (Security Check)
3. Begin a Database Transaction
4. try...catch block
5. ...Execute the core business logic...
6. finally block to Commit or Rollback the Transaction
7. Log "Finished method..."

Your real business logic (step 5) is just a few lines, but it's "drowned" in a sea of repetitive boilerplate. This repetitive code is known as Cross-Cutting Concerns.

This is precisely the problem Aspect-Oriented Programming (AOP) was designed to solve.

What is AOP?

AOP is a programming paradigm that allows us to separate (or modularize) cross-cutting concerns from our main business logic.

Think of it this way:

• OOP helps you slice your system vertically into classes and modules (like UserService, OrderService).
• AOP helps you slice your system horizontally by grouping a single concern (like Logging) that cuts across all your modules.

By doing this, your UserService can focus only on user logic. It doesn't need to "know" that it's being logged, timed, or wrapped in a transaction.

The Core Terminology (The "Jargon" You Must Know)

To understand AOP, you must be fluent in its five core terms:

1. Aspect

• What it is: The module or class that encapsulates a cross-cutting concern.
• Example: A LoggingAspect, a TransactionManagementAspect, or a SecurityAspect.

2. Join Point

• What it is: A specific point during the execution of your program where you could intervene.
• Example: Before a method is called, after a method returns, or when an exception is thrown.

3. Pointcut

• What it is: An expression or rule that selects one or more Join Points you want to target.
• Example: "All public methods in the UserService class," or "All methods annotated with @Transactional."

4. Advice

• What it is: This is the actual logic (the code) you want to execute at the Join Points selected by your Pointcut.

Common types of Advice:

• @Before: Runs before the Join Point. (e.g., Log "Starting...").
• @AfterReturning: Runs after the Join Point executes and returns successfully. (e.g., Log the result).
• @AfterThrowing: Runs if the Join Point throws an exception. (e.g., Log the error, send an alert).
• @After: Runs after the Join Point finishes, regardless of whether it was successful or threw an error (like a finally block).
• @Around: The most powerful. It wraps the Join Point. You can run code before, decide whether to execute the Join Point at all, run code after, and even modify the return value. This is used for transactions, caching, and timing.

5. Weaving

• What it is: The process where the AOP framework applies (or "weaves") the Advice to the targeted Pointcuts.

Simple Summary: You define an Advice (the 'what'—the logic). You use a Pointcut (the 'where'—the rule). You wrap them in an Aspect (the 'container'). The AOP framework performs Weaving (the 'how'—the application) to make it all work.

Practical Example: From "Messy" to "Clean"

Let's see how AOP cleans up our code.

1. Before AOP (The "Polluted" Code)

// Business logic is heavily "polluted" by logging and transaction code

public class OrderService {

    public void createOrder(Order order) {

        DatabaseConnection conn = null;

        Logger.log("Starting to create order for user: " + order.getUserId());

        try {

            conn = Database.getConnection();

            conn.beginTransaction(); // <-- Cross-Cutting Concern 1

            // ... Core business logic ...

            // (Check inventory, charge credit card, create order record...)

            // ...

            conn.commit(); // <-- Cross-Cutting Concern 1

            Logger.log("Order created successfully."); // <-- Cross-Cutting Concern 2

        } catch (Exception e) {

            if (conn != null) {

                conn.rollback(); // <-- Cross-Cutting Concern 1

            }

            Logger.error("Failed to create order: " + e.getMessage()); // <-- Cross-Cutting Concern 2

            throw new OrderCreationException("Error...", e);

        } finally {

            if (conn != null) {

                conn.close();

            }

        }

    }

}

The core logic (the // ... part) is buried.

2. After AOP (The "Clean" Code)

(This example uses syntax from Spring AOP / AspectJ, one of the most popular AOP implementations).

Step 1: The Business Logic (CLEAN):

// Just the business logic. Clean, readable, and easy to unit test.

public class OrderService {

    @Transactional // Declares "I need a transaction"

    @Loggable // Declares "I need to be logged"

    public void createOrder(Order order) {

        // ... Core business logic ...

        // (Check inventory, charge credit card, create order record...)

        // ...

        // No try-catch-finally, no logging. It's gone.

    }

}

Step 2: Define the Aspects (Where the logic went):

// Aspect 1: Handles Transactions

@Aspect

@Component

public class TransactionAspect {

    // An @Around Advice, wrapping any method marked with @Transactional

    @Around("@annotation(com.myapp.annotations.Transactional)")

    public Object manageTransaction(ProceedingJoinPoint joinPoint) throws Throwable {

        DatabaseConnection conn = null;

        try {

            conn = Database.getConnection();

            conn.beginTransaction();

            Object result = joinPoint.proceed(); // <-- This executes the real createOrder()

            conn.commit();

            return result;

        } catch (Exception e) {

            if (conn != null) conn.rollback();

            throw e; // Re-throw the exception

        } finally {

            if (conn != null) conn.close();

        }

    }

}

// Aspect 2: Handles Logging

@Aspect

@Component

public class LoggingAspect {

    @Around("@annotation(com.myapp.annotations.Loggable)")

    public Object logExecution(ProceedingJoinPoint joinPoint) throws Throwable {

        String methodName = joinPoint.getSignature().getName();

        Logger.log("Executing: " + methodName);

        long startTime = System.currentTimeMillis();

        try {

            Object result = joinPoint.proceed(); // <-- This executes the real createOrder()

            long timeTaken = System.currentTimeMillis() - startTime;

            Logger.log("Finished: " + methodName + ". Time taken: " + timeTaken + "ms");

            return result;

        } catch (Exception e) {

            Logger.error("Exception in: " + methodName + ". Error: " + e.getMessage());

            throw e;

        }

    }

}

How Does AOP Actually Work? (The "Magic" of Weaving)

This "magic" typically happens in one of two ways:

1. Runtime Weaving:
   • The most common method, used by Spring AOP.
   • The framework does not modify your code. Instead, at runtime, it creates a Proxy Object that wraps your real object.
   • When you call orderService.createOrder(), you're actually calling orderServiceProxy.createOrder().
   • This proxy object executes the Aspect logic (@Around), and inside that, it calls your real object (joinPoint.proceed()).
2. Compile-time Weaving:
   • Used by the full AspectJ framework.
   • This method modifies your compiled bytecode (the .class files) during or after compilation.
   • It literally "weaves" the advice code directly into your target methods.
   • Pro: Faster runtime performance (no proxy overhead).
   • Con: More complex build setup.

The Pros and Cons

Pros

• Clean Code: Your business logic is pure and focused.
• High Reusability: Write one LoggingAspect and apply it to 1,000 methods.
• Easy Maintenance: Need to change your logging format? You only edit one file (the Aspect), not 1,000.
• Enforces SRP: Your OrderService is now only responsible for one thing: managing orders.

Cons

• "Black Magic": Code seems to execute "from nowhere." A new developer looking at createOrder() won't see how transactions or logs are handled immediately.
• Debugging Hell: When an error occurs, the stack trace can be extremely long and confusing, filled with calls to proxies and aspect logic.
• Performance Overhead: Creating and calling through proxies adds a small performance cost compared to a direct method call.

Conclusion

AOP is not a replacement for OOP. It is a powerful complement to OOP. It's the "secret sauce" behind many features in major frameworks like Spring (for @Transactional, @Secured) and Quarkus (for caching, metrics).

Use AOP wisely for true cross-cutting concerns. Don't abuse it, and make sure your team understands the "magic" that's happening behind the scenes.

Whether you need scalable software solutions, expert IT outsourcing, or a long-term development partner, ISB Vietnam is here to deliver. Let’s build something great together—reach out to us today. Or click here to explore more ISB Vietnam's case studies.

References:

• Spring Framework AOP Documentation
• What is AOP - Aniday Blog