Java (Spring Boot) Backend Development for Mobile Applications
Spring Boot is chosen when team already has Java expertise, when backend must integrate with enterprise systems (SAP, Oracle, legacy SOAP services), or when architecture needs rich ecosystem: Spring Security, Spring Data JPA, Spring Batch, Spring Integration — mature tools with predictable behavior.
Where Spring Boot Works Better for Mobile API
Enterprise sector: banking, insurance, logistics. Mobile client is frontend to existing business logic already living in Java. Rewriting for "trendiness" in Go or Node is costly and risky. Spring Boot exposes REST API over existing services in weeks, not months.
Specific pain points to solve:
JVM cold start. Standard Spring Boot 3.x starts in 8–15 seconds — problem for Kubernetes autoscaling. Solved several ways: GraalVM Native Image cuts startup to 0.1–0.3 seconds (but requires careful reflect-config.json tuning), Spring WebFlux instead of Spring MVC shifts to reactive model (Reactor, Netty) and cuts memory footprint, or keep minimum two pods always running, never scaling to zero.
N+1 queries through Hibernate. Classic: @OneToMany without fetch = EAGER or without @EntityGraph, and mobile screen showing 20 users gets 21 SQL queries. Mobile client gets response in 800 ms instead of 50 ms. Diagnose via Hibernate Statistics (spring.jpa.properties.hibernate.generate_statistics=true) or Datasource Proxy, fix with JOIN FETCH or batch loading (@BatchSize).
API Architecture for Mobile Client
Stack: Spring Boot 3.x (Java 17+), Spring Data JPA + PostgreSQL (or MongoDB for document-oriented), Spring Security with JWT (library jjwt or nimbus-jose-jwt), Spring Cache + Redis, Spring Boot Actuator for health-check and metrics (Prometheus/Grafana).
For push notifications — Spring integrates with FCM via firebase-admin SDK (Maven dependency com.google.firebase:firebase-admin). APNs — via pushy library supporting HTTP/2 connection pool and proper 410 Gone handling for token invalidation.
Real case: fintech app, 150,000 registered users. Backend Spring Boot 2.7, PostgreSQL, Spring Data JPA. Endpoint /transactions/history with pagination regularly timed out on client. Reason — Hibernate loaded associated Merchant and Category entities separately for each transaction. Result: 50 transactions per page = 101 DB queries. After refactoring to @Query with JOIN FETCH and adding second-level cache via @Cacheable (EhCache) — response improved from 900 ms to 45 ms. Mobile client stopped showing loader longer than half second.
Security and Authentication
Spring Security 6 with SecurityFilterChain instead of deprecated WebSecurityConfigurerAdapter. Stateless auth: JWT in Authorization header. Refresh token — in httpOnly cookie for web, or in Keychain/Keystore for mobile with database storage and rotation.
OAuth2 / Social Login — spring-security-oauth2-client out-of-box supports Google, Apple (requires separate apple provider setup), Facebook. For mobile client, properly handling Apple's id_token is critical — non-standard flow with authorization_code and client_secret as ES256-signed JWT.
Project Structure and Layers
com.example.app
├── api — controllers, DTOs, mappers (MapStruct)
├── domain — entities, repository interfaces
├── service — business logic
├── infrastructure — JPA impl, Redis, FCM, S3
└── config — Spring configuration
MapStruct for entity → DTO mapping: generates code at compile time, no reflection overhead like ModelMapper.
Deployment and Operations
Docker image with layered JAR (COPY --from=build /app/layers), Jib plugin for building without Dockerfile. Kubernetes with readiness probe on /actuator/health/readiness and liveness probe on /actuator/health/liveness — Spring Boot 2.3+ supports separate probes out of the box.
HikariCP (default pool in Spring Boot) — configure maximumPoolSize by formula: (core_count * 2) + effective_spindle_count. For 4-core instance with SSD — 10 connections per pod sufficient. More doesn't mean faster.
Timeline: API with 15–20 methods, integration with one external system, authentication — 4–7 weeks. Full backend with realtime (WebSocket via Spring WebSocket / STOMP), notifications, analytics and CI/CD — 10–16 weeks.