Choosing the Right Java REST Framework - NY Java SIG 2023

Slide 1

Slide 1 text

Matt Raible | @mraible October 19, 2023 Choosing the Right Java REST Framework Micronaut, Quarkus, Spring Boot, and Helidon Photo by Florian Wehde https://unsplash.com/photos/high-rise-buildings-during-sunset-J6mySj3wntg

Slide 2

Slide 2 text

@mraible Who is Matt Raible? Father, Husband, Skier, Mountain Biker, Whitewater Rafter Bus Lover Web Developer and Java Champion Developer Advocate Architect Blogger on raibledesigns.com and developer.okta.com/blog @mraible

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

developer.okta.com

Slide 7

Slide 7 text

developer.auth0.com

Slide 8

Slide 8 text

@mraible Today’s Agenda Why Java? Build { REST, GraphQL } APIs with Java Secure your APIs with OAuth 2.1 Build with Docker Go Native with GraalVM https://unsplash.com/photos/JsTmUnHdVYQ

Slide 9

Slide 9 text

@mraible Why Java? 25+ Years of use, abuse, and improvements Open Source code is available; many popular open source frameworks and tools Hugely Popular and widely used by many enterprises and web-scale companies

Slide 10

Slide 10 text

@mraible Download the Oracle builds of OpenJDK https://jdk.java.net/21 Or Eclipse builds from Adoptium https://adoptium.net Get Started with Java 21

Slide 11

Slide 11 text

@mraible Get Started with Java 21 Better yet, use SDKMAN! curl -s https://get.sdkman.io | bash   sdk install java 21-open

Slide 12

Slide 12 text

Java Releases and Features

Slide 13

Slide 13 text

https://developer.okta.com/blog/2020/01/09/java-rest-api-showdown Build REST APIs with Java

Slide 14

Slide 14 text

https://developer.okta.com/blog/2021/06/18/native-java-framework-comparison Build Native Java REST APIs

Slide 15

Slide 15 text

https://developer.okta.com/blog/2022/01/06/native-java-helidon Build REST APIs and Native Apps with Helidon

Slide 16

Slide 16 text

Serverless 💵 💸 https://unsplash.com/photos/glRqyWJgUeY

Slide 17

Slide 17 text

Use Cases for Native Images https://twitter.com/therealdanvega/status/1666098085616046081

Slide 18

Slide 18 text

@mraible sdk install micronaut mn create-app com.okta.rest.app \ -f security-jwt -f micronaut-aot Get Started with Micronaut

Slide 19

Slide 19 text

https://micronaut.io/launch

Slide 20

Slide 20 text

package com.okta.rest.controller; import io.micronaut.http.MediaType; import io.micronaut.http.annotation.Controller; import io.micronaut.http.annotation.Get; import io.micronaut.http.annotation.Produces; import io.micronaut.security.annotation.Secured; import io.micronaut.security.rules.SecurityRule; import java.security.Principal; @Controller("/hello") public class HelloController { @Get @Secured(SecurityRule.IS_AUTHENTICATED) @Produces(MediaType.TEXT_PLAIN) public String hello(Principal principal) { return "Hello, " + principal.getName() + "!"; } }

Slide 21

Slide 21 text

micronaut.security.token.jwt.signatures.jwks.okta.url= https://dev-1337.us.auth0.com/.well-known/jwks.json Micronaut JWT Security

Slide 22

Slide 22 text

micronaut.security.token.jwt.signatures.jwks.okta.url= https://dev-1337.us.auth0.com/.well-known/jwks.json Micronaut JWT Security https://micronaut-projects.github.io/micronaut-security/latest/guide/#jwt

Slide 23

Slide 23 text

Install HTTPie (a better cURL) $ install httpie https://httpie.org

Slide 24

Slide 24 text

Test Micronaut with HTTPie https://httpie.org gradle run http :8080/hello TOKEN=eyJraWQiOiJxOE1QMjFNNHZCVmxOSkxGbFFWNlN... http :8080/hello Authorization:"Bearer $TOKEN"

Slide 25

Slide 25 text

Verify Micronaut API with HTTPie

Slide 26

Slide 26 text

@mraible Get Started with Quarkus sdk install quarkus quarkus create app com.okta.rest:quarkus \ --extension="smallrye-jwt,resteasy-reactive" --gradle

Slide 27

Slide 27 text

@mraible mvn io.quarkus:quarkus-maven-plugin:3.4.3:create \ -DprojectGroupId=com.okta.rest \ -DprojectArtifactId=quarkus \ -DclassName="com.okta.rest.HelloResource" \ -Dpath="/hello" \ -Dextensions="smallrye-jwt,resteasy-reactive" Get Started with Quarkus

Slide 28

Slide 28 text

https://code.quarkus.io

Slide 29

Slide 29 text

package com.okta.rest; import io.quarkus.security.Authenticated; import jakarta.ws.rs.GET; import jakarta.ws.rs.Path; import jakarta.ws.rs.Produces; import jakarta.ws.rs.core.Context; import jakarta.ws.rs.core.MediaType; import jakarta.ws.rs.core.SecurityContext; import java.security.Principal; @Path("/hello") public class HelloResource { @GET @Authenticated @Produces(MediaType.TEXT_PLAIN) public String hello(@Context SecurityContext context) { Principal userPrincipal = context.getUserPrincipal(); return "Hello, " + userPrincipal.getName() + "!"; } }

Slide 30

Slide 30 text

mp.jwt.verify.issuer=https:// dev-1337.us.auth0.com/ mp.jwt.verify.publickey.location= ${mp.jwt.verify.issuer}.well- known/jwks.json MicroProfile JWT Security https://www.eclipse.org/community/eclipse_newsletter/2017/september/article2.php

Slide 31

Slide 31 text

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

Test Quarkus with HTTPie https://httpie.org gradle --console=plain quarkusDev http :8080/hello TOKEN=eyJraWQiOiJxOE1QMjFNNHZCVmxOSkxGbFFWNlN... http :8080/hello Authorization:"Bearer $TOKEN"

Slide 34

Slide 34 text

Verify Quarkus API with HTTPie

Slide 35

Slide 35 text

@mraible Get Started with Spring Boot https start.spring.io/starter.tgz \ dependencies==web,oauth2-resource-server,native \ packageName==com.okta.rest \ name==spring-boot \ baseDir==spring-boot | tar -xzvf -

Slide 36

Slide 36 text

https://start.spring.io https://start.spring.io

Slide 37

Slide 37 text

@mraible Use the Spring Boot CLI sdk install springboot spring init -d=web,oauth2-resource-server,native \ --group-id=com.okta.rest \ --package-name=com.okta.rest spring-boot

Slide 38

Slide 38 text

package com.okta.rest.controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; import java.security.Principal; @RestController public class HelloController { @GetMapping("/hello") public String hello(Principal principal) { return "Hello, " + principal.getName() + "!"; } }

Slide 39

Slide 39 text

The Okta Spring Boot Starter https://github.com/okta/okta-spring-boot okta.oauth2.issuer=https://dev-1337.us.auth0.com

Slide 40

Slide 40 text

Test Spring Boot with HTTPie https://httpie.org gradle bootRun http :8080/hello TOKEN=eyJraWQiOiJxOE1QMjFNNHZCVmxOSkxGbFFWNlN... http :8080/hello Authorization:"Bearer $TOKEN"

Slide 41

Slide 41 text

Verify Spring Boot API with HTTPie

Slide 42

Slide 42 text

@mraible Get Started with Helidon mvn -U archetype:generate -DinteractiveMode=false \ -DarchetypeGroupId=io.helidon.archetypes \ -DarchetypeArtifactId=helidon-quickstart-mp \ -DarchetypeVersion=3.2.2 \ -DgroupId=com.okta.rest \ -DartifactId=helidon \ -Dpackage=com.okta.rest

Slide 43

Slide 43 text

https://helidon.io/starter

Slide 44

Slide 44 text

Use the Helidon CLI sdk install helidon helidon init --flavor MP \ --groupid com.okta.rest \ --artifactid helidon \ --package com.okta.rest --batch

Slide 45

Slide 45 text

package com.okta.rest.controller; import io.helidon.security.Principal; import io.helidon.security.annotations.Authenticated; import jakarta.ws.rs.GET; import jakarta.ws.rs.Path; import jakarta.ws.rs.core.Context; @Path("/hello") public class HelloResource { @Authenticated @GET public String hello(@Context SecurityContext context) { return "Hello, " + context.userName() + "!"; } }

Slide 46

Slide 46 text

package com.okta.rest; import com.okta.rest.controller.HelloResource; import org.eclipse.microprofile.auth.LoginConfig; import jakarta.enterprise.context.ApplicationScoped; import jakarta.ws.rs.core.Application; import java.util.Set; @LoginConfig(authMethod = "MP-JWT") @ApplicationScoped public class HelloApplication extends Application { @Override public Set> getClasses() { return Set.of(HelloResource.class); } }

Slide 47

Slide 47 text

MicroProfile JWT Security mp.jwt.verify.issuer=https://dev-1337.us.auth0.com/ mp.jwt.verify.publickey.location=${mp.jwt.verify.issuer}.well- known/jwks.json https://download.eclipse.org/microprofile/microprofile-jwt-auth-2.0/microprofile-jwt-auth-spec-2.0.html io.helidon.microprofile.jwt helidon-microprofile-jwt-auth

Slide 48

Slide 48 text

Test Helidon with HTTPie https://httpie.org mvn package && java -jar target/helidon.jar http :8080/hello TOKEN=eyJraWQiOiJxOE1QMjFNNHZCVmxOSkxGbFFWNlN... http :8080/hello Authorization:"Bearer $TOKEN"

Slide 49

Slide 49 text

Verify Helidon API with HTTPie

Slide 50

Slide 50 text

@mraible Startup Performance Milliseconds 0 500 1000 1500 2000 Micronaut Quarkus Spring Boot Helidon 1,053 952 430 433 896 743 1,402 399 Dev Startup (gradle or mvn) Packaged Startup (java -jar)

Slide 51

Slide 51 text

@mraible What about GraphQL APIs? Why GraphQL? Does your favorite framework support GraphQL? Micronaut https://micronaut-projects.github.io/micronaut-graphql/latest/guide Quarkus https://quarkus.io/guides/smallrye-graphql Spring Boot https://spring.io/projects/spring-graphql Helidon https://helidon.io/docs/v3/#/mp/graphql

Slide 52

Slide 52 text

@mraible Secure your API with OAuth 2.1 https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1

Slide 53

Slide 53 text

@mraible Secure your API with OAuth 2.1 https://oauth.net/2.1 PKCE is required for all clients using the authorization code flow Redirect URIs must be compared using exact string matching The Implicit grant is omitted from this specification The Resource Owner Password Credentials grant is omitted from this specification Bearer token usage omits the use of bearer tokens in the query string of URIs Refresh tokens for public clients must either be sender-constrained or one-time use

Slide 54

Slide 54 text

@mraible Authenticate with OpenID Connect (OIDC) What is OpenID Connect? Does your favorite framework support OIDC authentication? Micronaut https://guides.micronaut.io/latest/micronaut-oauth2-auth0.html Quarkus https://quarkus.io/guides/security-openid-connect-web-authentication Spring Boot https://docs.spring.io/spring-security/reference/servlet/oauth2/login Helidon https://helidon.io/docs/v3/#/mp/security/providers#OIDC-Provider

Slide 55

Slide 55 text

What about testing?

Slide 56

Slide 56 text

@mraible Build with Docker Create a Dockerfile   FROM openjdk:21-alpine ARG JAR_FILE=target/*.jar COPY ${JAR_FILE} app.jar EXPOSE 8080 ENTRYPOINT ["java","-jar","/app.jar"]

Slide 57

Slide 57 text

@mraible Build with Docker Build your image docker build -t . Run your image docker run -it -p 8080:8080

Slide 58

Slide 58 text

@mraible Build with Docker: Jib Get Jibby with it! mvn verify jib:build gradle jib Or build directly to your Docker daemon mvn verify jib:dockerBuild gradle jibDockerbuild https://github.com/GoogleContainerTools/jib

Slide 59

Slide 59 text

@mraible Build with Docker Micronaut uses Jib, but you must configure plugins Quarkus generates four Docker-related files Dockerfile.jvm Dockerfile.legacy-jar Dockerfile.native Dockerfile.native-micro Quarkus + Jib mvn quarkus:add-extension -Dextensions="container-image-jib" gradle addExtension --extensions="container-image-jib"

Slide 60

Slide 60 text

@mraible Build with Docker Spring Boot 2.3+ has built-in support mvn -Pnative spring-boot:build-image   gradle bootBuildImage   Uses layered JARs for faster builds dependencies snapshot-dependencies resources application https://spring.io/blog/2020/01/27/creating-docker-images-with-spring-boot-2-3-0-m1

Slide 61

Slide 61 text

@mraible Build with Docker Helidon generates three Docker-related files Dockerfile Dockerfile.jlink Dockerfile.native Helidon + Jib Not available

Slide 62

Slide 62 text

@mraible Use Micronaut CLI mn create-app ... mvn package -Dpackaging=native-image gradle nativeImage gradle dockerBuildNative Go Native with GraalVM and Micronaut https://docs.micronaut.io/latest/guide/#graal

Slide 63

Slide 63 text

@mraible Go Native with GraalVM and Quarkus Create an executable without GraalVM installed mvn package -Dnative -Dquarkus.native.container-build=true gradle build -Dquarkus.package.type=native \ -Dquarkus.native.container-build=true Then, build the image docker build -f src/main/docker/Dockerfile.native -t \ . And run it docker run -it -p 8080:8080 https://quarkus.io/guides/building-native-image

Slide 64

Slide 64 text

@mraible Use start.spring.io to get plugins Go Native with GraalVM and Spring Boot org.graalvm.buildtools native-maven-plugin org.springframework.boot spring-boot-maven-plugin plugins { ... id 'org.graalvm.buildtools.native' version '0.9.27' }

Slide 65

Slide 65 text

@mraible Go Native with GraalVM and Spring Boot Build the native application mvn native:compile -Pnative gradle nativeCompile Build an image and Docker container mvn spring-boot:build-image -Pnative gradle bootBuildImage

Slide 66

Slide 66 text

@mraible Build the image docker build -f Dockerfile.native -t . And run it docker run --rm -p 8080:8080 Go Native with GraalVM and Helidon

Slide 67

Slide 67 text

@mraible Native Startup Performance (M1; time from console) Milliseconds 0 12 24 36 48 60 October 19, 2023 35.6 50.4 40.4 27.2 17.8 17 Micronaut 4.1.5 Micronaut (optimized) Quarkus 3.4.3 Spring Boot 3.1.5 Helidon 3.2.2* Helidon (optimized)

Slide 68

Slide 68 text

@mraible Native Startup Performance (M1; scripted) Milliseconds 0 25 50 75 100 October 19, 2023 53.6 67.8 71.6 52.6 49 48.2 Micronaut 4.1.5 Micronaut (optimized) Quarkus 3.4.3 Spring Boot 3.1.5 Helidon 3.2.2* Helidon (optimized)

Slide 69

Slide 69 text

@mraible Tests Run on a 2021 MacBook Pro M1 Max

Slide 70

Slide 70 text

@mraible t2.small: 1 vCPUs and 2 GiB RAM - Fails to build any projects t2.medium: 2 vCPUs and 4 GiB RAM - Quarkus and Spring Boot fail to build; Helidon took too long t2.large: 2 vCPUs and 8 GiB RAM 🌟 Building GraalVM images on AWS

Slide 71

Slide 71 text

@mraible Native Startup Performance (AWS EC2 t2.large) Milliseconds 0 20 40 60 80 100 October 19, 2023 95.4 39.8 44 43 Micronaut 4.1.5 Micronaut (optimized) Quarkus 3.4.3 Spring Boot 3.1.5

Slide 72

Slide 72 text

@mraible Native Memory Used after 5 requests (M1) Megabytes 0 30 60 90 120 150 October 19, 2023 123 117 84 53 67 64 Micronaut Micronaut (optimized) Quarkus Spring Boot Helidon Helidon (optimized)

Slide 73

Slide 73 text

@mraible Native Memory Used after 5 requests (EC2 t2.large) Megabytes 0 30 60 90 120 150 October 19, 2023 92 56 70 71 Micronaut Micronaut (optimized) Quarkus Spring Boot

Slide 74

Slide 74 text

@mraible Demo Time! https://github.com/oktadev/auth0-java-rest-api-examples

Slide 75

Slide 75 text

Community

Slide 76

Slide 76 text

@mraible Stack Overflow Tags 0 45,000 90,000 135,000 180,000 October 17, 2023 139 144,464 4,112 1,704 Micronaut Quarkus Spring Boot Helidon

Slide 77

Slide 77 text

@mraible GitHub Stars 0 20,000 40,000 60,000 80,000 October 17, 2023 3,200 69,700 12,400 5,800 Micronaut Quarkus Spring Boot Helidon

Slide 78

Slide 78 text

https://star-history.t9t.io/#micronaut-projects/micronaut-core&quarkusio/quarkus&spring-projects/spring-boot&oracle/helidon GitHub Star Growth

Slide 79

Slide 79 text

@mraible Jobs on Indeed (US) 0 2,500 5,000 October 17, 2023 15 3,985 65 48 Micronaut Quarkus Spring Boot Helidon

Slide 80

Slide 80 text

@mraible Twitter Followers 0 30,000 60,000 90,000 120,000 October 17, 2023 4,531 103,300 18,400 13,300 Micronaut Quarkus Spring Boot Helidon

Slide 81

Slide 81 text

@mraible JHipster Support 🤓 Spring Boot 3 - JHipster 8.0.0-rc1, 8.0.0 coming soon! Micronaut blueprint - github.com/jhipster/generator-jhipster-micronaut - v2.0.0 for Micronaut 3, 19 releases, 20 contributors, 495 commits - v3.0.0 with Micronaut 4 with JHipster 8 is next! Quarkus blueprint - github.com/jhipster/generator-jhipster-quarkus - v2.0.0 for Quarkus 2, 7 releases, 18 contributors, 653 commits - v3.0.0 with Quarkus 3 is on the horizon!

Slide 82

Slide 82 text

https://auth0.com/blog/full-stack-java-with-react-spring-boot-and-jhipster

Slide 83

Slide 83 text

@mraible 🏆 Quarkus provides the best developer joy and memory usage 🚀 Micronaut is consistently competitive and 4.0 starts the fastest! 🌱 Spring Boot has the strongest community, ecosystem, and growth 🔮 Helidon has a lot of catching up to do ⚡ Spring Boot 3 not as fast as expected My Thoughts

Slide 84

Slide 84 text

@mraible Action! New to Java? Try Spring Boot Know Spring? Trial migration paths Testing is important, invest early and often Design your apps with security in mind Use OpenID Connect and OAuth 2.1 https://unsplash.com/photos/JsTmUnHdVYQ

Slide 85

Slide 85 text

developer.auth0.com developer.okta.com @oktadev

Slide 86

Slide 86 text

Subscribe to our Zero Index newsletter! a0.to/nl-signup/java

Slide 87

Slide 87 text

git clone https://github.com/oktadeveloper/okta-spring-web fl ux-react-example.git https://github.com/oktadev/auth0-java-rest-api-examples Use the Source, Luke!

Slide 88

Slide 88 text

No content

Slide 89

Slide 89 text

Thanks! Keep in Touch raibledesigns.com @mraible Presentations speakerdeck.com/mraible Code github.com/oktadev developer.okta.com developer.auth0.com