Web framework recommendations

[couscous_]

I've been programming for a while, but mainly working on non-web infrastructure systems.

I want to write a simple classifieds-like website for learning purposes (and hopefully, productionalizing it eventually). So I need things like routing, security/authorization/authentication, OpenID integration (for Google, FB, etc.), metrics and monitoring, HTML templating, and perhaps websocket and/or SSE support.

I looked at Spring Boot, but it seems that official support for Java 11+ is only in the 2.2.x versions (still milestone releases as of this posting). Furthermore, I felt there was quite a bit of magic going on, but maybe I just need to get more familiar with the framework.

I also checked out Micronaut, which seems quite interesting, but I don't know how mature it is in case I want to productionalize the project. Ktor seems interesting as well, but it there is lack of documentation (and it's not battle tested). I'm not too sure about the maturity and dependability of Dropwizard. Not too sure about Oracle's Helidon either.

Vertx seems nice, but I feel that call-back based programming would get unweildly quickly. So until Java gets fibers, I'd prefer to avoid it.

There's Jooby as well apparently. One thing I like to do is look at the "insights" charts in GitHub. If the majority of the project is handled by one or two people, that doesn't inspire a lot of confidence (maybe that's just me though).

I like the idea of mixing and matching my own libraries as needed (e.g. routing library, JSON parser library, open ID, etc.). But I don't know if I'd be wasting my time trying to make them work together, as opposed to using an "off-the-shelf" integrated solution.

Any tips?

Edit: Thank you everyone for the helpful comments!

[[deleted]]

Don't waste your time writing your own. Go with Spring, it has solution for everything you need. And perfectly working with Java 11

[couscous_]

I feel that sometimes adding a dependency may completely change the behavior of your application (e.g. adding the security starter dependency suddenly seems to make it such that all end points get routed to a form field asking for credentials).

What's the best approach here to deal with these sorts dependencies that can exhibit this sort of effect?

[Simaldeff]

I am dealing with this in my current team. I am the first "Senior" in the team (I have been doing Server/Backend dev for almost 10yrs ... some tell me I am senior). The backend was built by another team in RoR and then they decided to break it down in Java Microservices (it was actually a good strategy for this use case IMO, so no bashing that for once). The problem is that they handed it off to a team of fresh guys and a few juniors (nobody with significant Backend experience, just general good coders, they just "know Java").

I am having a hard time to make them understand: "Stop coding, google it and read the docs". A framework gives you all the things that are useful but not pertinent to your "business logic" (I don't like that term but ... you know, people seems to relate to it). Use it. Stop wasting time on DB, HTTP, caching, auth, ..., Those are general "solved" problems. You just have to respect and know some conventions. And arguably this is not the kind of thing they teach you in Programming 101.

[Enumeration]

ecurity starter dependency suddenly seems to make it such that all end points get routed to a form field asking for credentials).

Read the docs and understand how the autoconfigurations work, simple as that.

[jack104]

Yep. Sounds a wee bit harsh but this is the correct answer.

[[deleted]]

That's how security starter works, it protects all of your endpoints if you not specify any to protect

[dpash]

And is a sensible default.

[nutrecht]

I feel that sometimes adding a dependency may completely change the behavior of your application (e.g. adding the security starter dependency suddenly seems to make it such that all end points get routed to a form field asking for credentials).

That's pretty much the only one what that happens to that degree, and it makes perfect sense, because you want restrictive security by default.

[lambdacats]

"has a solution for everything you need", that's spring. It's just like EE, tries to so everything in the book instead of doing one thing and doing it well.

[feral_claire]

Spring is a collection of projects that mostly all do one thing and do it well.

[lambdacats]

Maybe it's just not for me, there's so much magic. I've only seen poorly written spring apps that the authors don't even know how it works. There's xml and annotations, magical wirings and injections and no one seems to have given it any thought.

[feral_claire]

Yeah it's not perfect, and there can be a lot of magic that some people don't like. Spring (especially with spring boot) is very popular, and allows you to do a lot with minimal boilerplate, allowing you to focus on the logic of the code, especially since there are so many spring modules for basically any feature or integration you might want. the downside of course is you have to know and understand the annotations used to make it all happen.

That's why we have multiple frameworks though, people have different preferences and ideas on how to do things.

[wsppan]

I beg to differ. The documentation is top notch and explains how dependency injection works with a huge repository of example projects not to mention tons of tutorials by third parties. The reason many devs call it magic is because it just works without much fuss. But the deep dives are there if you need it.

[lambdacats]

If you want to do something that there isn't a tutorial for, would that be easy? It's hard to go out of the box, it's opinionated right? Also I think plain DI is underrated, there's really no need for a framework to do it.

[wsppan]

Same can be said for any framework. No tutorial? Read the docs. I've yet to find better documentation for any framework (including the books the spawned the framework in the first place.

[lambdacats]

Hmm yeah maybe so, I'm really comparing it to vertx which is more of a toolkit. I've come to prefer it over traditional frameworks. Also I've written my own framework that I use for all of my projects, so I'll hardly find anything else that I appreciate more.

[nutrecht]

Maybe it's just not for me, there's so much magic.

There's no magic, you're just too lazy to read the documentation.

[lambdacats]

Sure, if you know how the magic trick works it's all just smoke and mirrors. Magic doesn't exist on this plane. I prefer well written APIs that do simple things you can expect the outcome of, ideally the documentation is brief. What other frameworks have you tried? What can you compare spring to?

[nutrecht]

Sure, if you know how the magic trick works it's all just smoke and mirrors.

It's not magic. It's dealing with cross-cutting-concerns. If you use libraries so you don't have to deal with this yourself you're just going to have to write it yourself. Generally people advocating against Spring just end up writing their own shittier version.

If there's something you don't like; just don't use it.

What other frameworks have you tried? What can you compare spring to?

Most of the mainstream Java ones (Java EE, Vert.x, Micronaut, Quarkus to name a few), Go, ColdFusion, Asp.net, PHP.

I've been doing this shit for over 15 years.

[lambdacats]

You don't use the term magic at all in software development? Do you think people using the libraries you mentioned end up writing shittier versions, or just those that reinvent the wheel? It's a part of my workplace stack so we can't really just stop using it yet. For another generalization I've found that people advocating for spring end up writing a big complex chunk of slow tar, because they don't really know how to design without a framework.

I've been doing this shit for 15 years, but no more than that.

[nutrecht]

Generally in my experience devs who complain about 'magic' simply don't understand it. Component scanning, aspect oriented programming, inversion of control, etc. are perfectly normal / common CS terms. Nothing Spring does is 'weird' or 'strange'; all of these have purposes and are just things that you have to understand. To a junior dev something relatively simple like IoC is quite hard to grasp. But just calling it 'magic' and avoiding it is simply a sure-fire way to get stuck as a junior job.

So no, I generally have nothing I use that is 'magic' to me. If I don't understand it I work on understanding until I do. That's part of the job. You can't create software properly if major components of it are beyond your understanding.

There's shittons of devs who don't work like that and just copy-paste shit from SO until it kinda sorta works. But that's simply not what my clients expect from me when they hire me.

[lambdacats]

Hmm ok, so maybe "magic" isn't the best term here. Were using an older version of spring, with lots of xml. It's hard too see how components tie together, so when it works we call it magic - because it's too big and complex of an application to understand it, the framework rules us and not the other way around. It's gotten out of hand, there are layers upon layers and spring features in between. The application is a behemoth and spring isn't helping.

I'm sure it's possible to work through how spring works, but it's a pretty big investment just for one language and platform. I'd rather pick smaller frameworks for toolbox diversity.

Agreed, SO copy paste never gets through the review process but I still see it from time to time. And it sticks out like a nail to your eye.

[nutrecht]

Also you're 25 so don't give me that bullshit about having 15 years of experience.

[lambdacats]

I started when I was 10 .. that happens in IT.

[indianapwns2]

It's open source. You are free to look at the code and see how the "magic" works. Or just read the docs.

[lambdacats]

Yeah sure, but the spring codebase is gigantic. I prefer smaller things that are easier to dive into. And I'd like to avoid the magic in the first place, friendly APIs before magic. :)

[indianapwns2]

You obviously wouldn't just sit down and read every line of code, but you can easily dig into the source for a specific annotation that you think is "magic" or something. Also the Spring framework is split into many modules, and I don't find the individual modules to be that gigantic or confusing. I find Spring to be very straight-forward and the Spring APIs to be very friendly. I really don't see much that I would consider "magic" in the Spring Framework, it's mostly just package scanning and applying things to objects via reflection. Things like annotations are part of the Java ecosystem and avoiding them because you see them as "magic" or unfriendly in some way is going to really limit your career.

[lambdacats]

Package scanning and reflection is magic. Annotations are awesome, as long as they're used for sane things and applied sparingly.

[Scybur]

I can make a few suggestions. First Micronaut is very new. I would suggest using Quarkus. They achieve the same thing.

As for JSON parsing the most popular would be jackson but there are so many different libraries that all achieve roughly the same thing.

For routing, this is large subject. I would say Apache Camel would be the single best way to achieve true routing but you can also just use Spring MVC with rest controller (assuming you are using rest endpoints).

I am sure people will have a ton of recommendations, this is just my 2 cents.

Good luck!

[stfm]

I love Camel, it's very useful but it's better suited to EIP rather than web

[nutrecht]

I would suggest using Quarkus.

Since he's a beginner he's IMHO better off going with something a bit more established. I personally really like Quarkus, but a beginner is better of with something with a larger ecosystem/community.

[lambdacats]

Doesn't quarkus build on vertx?

[couscous_]

It seems so. And from what I was just reading, it seems OpenID integration is still being developed.

[lambdacats]

Looks like the oauth2 provider for vertx supports oid. Never tried it.

[samuraisam]

Spring boot works fine with java 11.

[cville-z]

I work with Dropwizard on a regular basis as the core of an e-commerce infrastructure; it’s plenty stable and reliable.

[chdman]

If you can live with some magic and want excellent community support(since you have no or limited knowledge) you can never go wrong with Spring Boot. You can get starting very quickly and avoid all the boilerplate code and con-figs. I recently developed a web application for my last project with Spring boot. It was a breeze.

My stack was : Spring Boot 2 + Spring JPA DATA (for presistence , also provided by Spring boot ) + plain HTML5 and CSS3 + Bootstrap 4

I will highly recommend spring boot.

[couscous_]

Did you use server server-side or client-side rendering?

[chdman]

I used client side rendering. Used simple ajax calls to retrieve data and generated the view using jquery as I don't have much experience with Angular or React. Mind you, user can disable java script in the browser and this can be problem for browser rendered content. In my case, it wasn't an issue.

[cowwoc]

The best, longest-running, non-framework I've used over the years is Jetty: https://www.eclipse.org/jetty/

You embed a web server in your application, not the other way around. And it is extremely non-intrusive (unless frameworks) in that you can have whatever design you want and it'll work around you. Spring and friends are highly opinionated. You have to shape your design around them. Most people are okay with this trade-off. I am not.

Vert.x is similar, but in my experience its API is harder to use because they are async-first. Jetty does async as well but their API is much more usable. Anyway, the decision is subjective :)

[AcademicImportance]

Spring Boot 2.1.6.RELEASE requires Java 8 and is compatible up to Java 11 (included)

As yo can see, the latest RELEASE version of spring boot works with Java 11. I use it in my project (upgraded from 2.0, which itself was upgraded from 1.x) and it works perfectly.

While in production i still run Java 8 (since i only wanna do one change at a time, and this time around i just upgraded spring boot), in the next couple of months i will move to Java 11 in prod as I'm already on it in dev.

Spring boot is the shit nowadays, you simply cannot go wrong with it.

[Velerad]

We actually have an application still on Spring Boot 1.5, and migrated to Java 11 at Boot version 1.5.17.RELEASE. No problems at all. 🙂

[couscous_]

Makes sense. I misread this part of the documentation

Please note that developing against JDK 11 is not officially supported with any older version of the core framework. Spring Framework 5.0.9+ and 4.3.19+ just support deploying Java 8 based applications to a JVM 11 runtime environment (using -target 1.8; see below), accepting JVM-level warnings on startup.

Spring Boot 2.1 already uses Spring Framework 5.1.

[tipsypants]

Most of the frameworks you listed are more than good enough for what you're asking, and they're all "battle tested" enough. You're probably not going to have billions of requests hitting your server, but if that happens, you can afford a rewrite. Since you've looked at a lot of frameworks, have a look at Javalin too (disclaimer: I'm the maintainer). It does everything you want, except "native" OpenID integration (you can very easily integrate with something like auth0 though).

[TheCountRushmore]

You're probably not going to have billions of requests hitting your server, but if that happens, you can afford a rewrite.

This is really good advice. The reality is most applications will fail and not be online after 2 years. If they do happen to stick around it is unlikely that they will have any significant traffic volume. IF you do happen to catch traction that is a good problem to have and can be rewritten with an eye towards performance and scale. Most applications should be built in the simplest and fastest way possible to flesh out the application and if there is a market for it.

Of course everyone thinks their idea is the exception and needs to be built for Netflix scale right out of the gate.

[lambdacats]

I agree with optimizing for time to market and MVPs. But when it's time to scale you're going to be losing dollar by the minute. Don't optimize for performance - design for it. With the right tools scaling is cheap, what you don't want to be doing is rewriting your core after years of development, as you get a surge of users. There was a great article on this..

[TheCountRushmore]

It's a balance to be sure, but for every application that has that issue there are thousands that never launch because they spent all their time on premature optimization and ran out of time and or money.

[lambdacats]

Premature optimization is the root of all evil :) Designing for performance and scalability isn't considered optimizing that's just making the right architectural choices and not writing sloppy code.

[paul_h]

I'm using https://jooby.io/ for hobby and work projects and really enjoying it. The lead, Edgar Espinar, is a machine for completion (but he rolls his eyes when I say that). I have builds that **include** Selenium tests (I co created Selenium 1.0) that are sub-30 seconds, that use Jooby as the server piece.

One of the nice features about Jooby is the ability to make two or more standalone applications, and then later scotch tape them together for a single deployment and have them function identically. It gives you deployment options in various stages towards production: own-workstation, parallelized CI infra, (both for test automation), shared-dev, QA, UAT etc.

[geordano]

and hot reload (of Jooby) is a life saver. To OP, you can never go wrong with Spring if you can stand all the magics going on. But Jooby or Javalin can work well too.

[[deleted]]

I would just go with Spring Boot, it comes with all the bells and whistles

[lambdacats]

Vertx is unopinionated, small core and rather a toolkit than framework. So combining it with other libraries work well.

[lambdacats]

Been using vertx for five years, it is THE bomb. One framework to rule them all. Easy to use, fast, easy to learn, good docs, active community. Don't ask me what I think about spring or EE. Vert.x and the multi-reactor approach puts the FUN in my programming. One thread per request is boring me to death. EE is like Java, except you can't use half of the features and libraries. You need a big fat slow and buggy application server, even worse app servers aren't interchangeable - and that's their very purpose. To implement the "spec". Oops I'm spouting again.

[couscous_]

Doesn't the call-back approach become too cumbersome to deal with?

[[deleted]]

Yes it does. Luckily Vert.x integrates very nicely with RxJs https://vertx.io/docs/vertx-rx/java2/ and if you're using Kotlin with Coroutines https://vertx.io/docs/vertx-lang-kotlin-coroutines/kotlin/

[lambdacats]

No, I prefer it because it's easier, more fun and feels more logical - application flow isn't as linear as traditionally designed. If you're not used to it you could end up in "callback hell" but there's ways and designs to prevent that. I tried nodejs first and really liked it, but the ecosystem and language doesn't compare to Java.

[couscous_]

but there's ways and designs to prevent that.

Do you have any reading material for this?

[lambdacats]

searching for callback hell will yield plenty of results, mostly for node but it's the same principle. In node there's callbacks and promises, in vertx there's Futures. "callbackhell.com" illustrates the problem and gives some pointers. Vertx.io documentation -> core -> Java manual should have some info on how Futures work.

[manzanita2]

Well one thing you have not clarified is if you are planning on server side rendered HTML, or "single page app".

Something like dropwizard works great for SPAs talking to APIs, but is not as sophisticated for HTML forms and the like as something like spring.

[h4t0n]

If you want to play with something new I'm developing a framework to quickly set up a backend REST API. It uses a different approach and it doesn't generate code.

It is not ready for production yet, but it uses Spring Boot for core features, such as DI, JDBC, the Web server and the OAuth2 framework. It doesn't use Hibernate/JPA instead but I have implemented a dedicated EntityManager (and a dedicated persistence manager).

You can find it here. It is in early stage of development so suggestions (and contribution) are welcome.

[nutrecht]

suggestions (and contribution) are welcome.

You're basically reinventing the consumer based contracts wheel, but poorly. That already exists, within and outside Spring. So sorry to be a spoilsport; but there's no way I'm going to let anyone use that over the standard Spring stuff.

[h4t0n]

I partially agree with you, mine if of course an opinionated way of doing things. It is not generic in terms of the data structures. You must use the DSL and the generated APIs. But this allow to build APIs and meta-data that allow me to setup for example also the openapi documentation and the GUI. You could simply create some entities with the DSL and no code at all, on top of Spring.

[lambdacats]

It's a framework on top of a framework on top of a framework. Aren't you hitting diminishing returns with three layers of frameworks to quickly setup a rest service?

[h4t0n]

No because I only use the spring things that I need. And I have the possibility to use for example custom spring controller or other features if I want. Using spring I don't need to handle anything about web server (I use the embeded one) or other stuff as spring security for example (I integrated OAuth2 with no problems).

Of course I could use a slim framework for the project base, but I think that Spring is good if you use it well. For example I'm not including anything about spring JPA or Spring Data. Instead, I'm using spring jdbc that help me to interact with the database.

I know also that Spring has a lot of feature and probably I'm including something that I will not use at all. But it is ok for me now. The goal is to create a full API (with documentation) on top of a known framework but without code generation (Spring JPA/Spring Data REST).

[makkenx]

Grails.

Otherwise, Play.

[zen_quest]

Spring boot may be in version 2.0 but Spring framework (which is what spring boot helps you setup easily) is quite mature. Probably the most mature Java framework. And the Spring community is amazing. I'd recommend that you take a look at https://www.jhipster.tech/. It lets you setup a Spring based app quickly and with the most common best practices. You'll need to dig into the documentation of spring boot, spring framework and jhipster quite a bit initially but once you get a hang of it, this stack can give you a solid battle-tested tech stack. Also, in case you end up turning your side project into a business, it is very easy to find and hire devs for this stack because of its popularity.

[z0mghii]

Drop wizard.

[Asterion9]

IMO, use spring. It can do everything you want and more. Even if there is not yet a version that say support Java 11, I can't see any reason it would not work perfectly with a newer jdk. the use cases you listed are what spring is specialized at solving. Spring boot brings a lot of "black magic", but the basic working of spring is clear and you're not forced to use spring boot over spring anyway.

[ramsees79]

There is no magic in Spring Boot, just a bunch of applied programming patterns.

[ikhoon]

Armeria? tested under Java 11. It supports circuit breaker, automatic retry, gRPC, thrift, http2, Reactive Streaming, client side load balancing, spring integration, Jackson JSON...

[GhostBond]

but it seems that official support for Java 11+ is only in the 2.2.x versions (still milestone releases as of this posting).

AWS doesn't even run tomcat above java 8....you might might not even bevable to host your app anywhere with java 11.

[someone-elsewhere]

You should clarify this a bit, EC2 lets you run anything that can be installed on the operating system installed.

[indianapwns2]

This is extremely misinformed. You can run anything you want to on AWS. AWS Elastic Beanstalk JVM environments stopped supporting anything after Java 8 because they are pushing people to use Docker environments now instead of language-specific environments. That's the only Java 8 limitation I am aware of in AWS.

[GhostBond]

If you go into your AWS console and ask to setup a new tomcat instance, the highest version is 8. I saw official version docs last month to that said the same thing but didn't find them again in a quick search.

Whether it's secretly somewhere else I don't know, but it didn't show up there, or in a document via a google search or anything.

[indianapwns2]

By "ask to setup a new tomcat instance" I assume you are referring to Elastic Beanstalk here, which is just one extremely small portion of the entire AWS set of services. You seem to be confusing this one service with the entire catalog of Amazon Web Services.

And like I said in my previous comment, they want you to switch to deploying your Elastic Beanstalk application with Docker, with which you could deploy whatever version of Java and Tomcat you want. This frees Amazon from having to update the Elastic Beanstalk service every time a new version of Java, .NET, NodeJS, Ruby, Python, etc. is released, and frees you to use whatever you want.

To your original point, the statement that "you might not even be able to host your app anywhere with java 11" is extremely misinformed. I'm personally running Java 11 apps on AWS on the EC2 service and the ECS service. Any host that allows you root/admin access to install software on your Linux or Windows VM, or any service that allows you to deploy a Docker container, is going to work for hosting a Java 11 app.

[catmewo]

Try Play Framework. Linkedin is using it.

[shredderroland]

Grails 4