Glossary

86 practical terms for Java backend interviews and day-to-day work.

@ 1 A B C D E F G H I J L M N O P R S T V W Z

@Transactional propagation: Controls how a transactional method joins an existing transaction: REQUIRED (default) joins, REQUIRES_NEW suspends and starts a separate one, MANDATORY demands one. By default only unchecked exceptions roll back, and a rollback inside a joined call marks the whole outer transaction rollback-only. See also: Proxy Isolation level Dirty checking
12-factor app: A set of practices for cloud-native services: config in the environment, stateless processes, logs as event streams, disposable processes and dev/prod parity. In Spring Boot this means externalised config and no local-disk or in-memory session state. See also: Profile Structured logging Graceful shutdown
Actuator: Spring Boot module exposing operational endpoints such as /actuator/health, metrics and prometheus. Expose only what you need and protect the rest; an open heapdump or env endpoint is a serious leak. See also: Liveness vs readiness Observability Profile
AOP (Aspect-Oriented Programming): Moves cross-cutting concerns such as logging, metrics and security out of business code into aspects applied by pointcut. Spring AOP works through runtime proxies, so it only advises public calls on Spring beans coming from outside. See also: Proxy @Transactional propagation Bean
API gateway: A single entry point that routes requests to backend services and handles cross-cutting concerns such as auth, rate limiting, TLS and request logging (Spring Cloud Gateway, Kong). Keep business logic out of it or it becomes a bottleneck and a deployment coupling point. See also: Rate limiting Service discovery JWT (JSON Web Token)
At-least-once delivery: The broker redelivers until acknowledged, so no message is lost but duplicates happen (Kafka consumers after a rebalance, SQS visibility timeouts). Make consumers idempotent. See also: Exactly-once processing Idempotency key DLQ (dead-letter queue)
Auto-configuration: Spring Boot's mechanism for registering beans based on the classpath and properties, using @ConditionalOn... rules. If a bean of that type is defined by you it backs off; debug what applied with --debug or the conditions report. See also: Starter Bean Profile
Backpressure: A mechanism by which a slow consumer signals producers to slow down instead of letting queues grow without bound. Bounded queues, Flux demand in Reactor, and rejecting with HTTP 429/503 are all forms of it. See also: Thread pool Rate limiting Circuit breaker
BCrypt: A deliberately slow, salted password-hashing function with a tunable cost factor, the usual PasswordEncoder in Spring Security. Never store passwords with plain SHA-256 or MD5; note that bcrypt truncates input at 72 bytes. See also: HMAC JWT (JSON Web Token)RBAC (Role-Based Access Control)
Bean: An object whose lifecycle is managed by the Spring container, declared with @Component, @Service or an @Bean method. Only objects obtained from the container get injection, proxies and AOP; calling new on your own class bypasses all of it. See also: IoC (Inversion of Control)Bean scope Proxy
Bean scope: Defines how many instances Spring creates: singleton (default, one per context), prototype, or web scopes such as request. Singletons are shared by all threads, so never keep per-request mutable state in fields. See also: Bean Race condition ThreadLocal
Blue/green deployment: Run the old (blue) and new (green) versions side by side and switch traffic over at once, keeping blue for instant rollback. Database schema changes must stay compatible with both versions. See also: Canary release Schema migration Graceful shutdown
Bytecode: The platform-independent instruction set stored in .class files, executed by the JVM interpreter or compiled by the JIT. Inspect it with javap -c; frameworks such as Hibernate and Spring generate or rewrite it at run time to build proxies. See also: JIT compiler (just-in-time)ClassLoader Proxy
Cache stampede: When a hot key expires, many concurrent requests miss at once and all hit the database. Mitigate with per-key locking or request coalescing, jittered TTLs, or refreshing before expiry (Caffeine's refreshAfterWrite). See also: Cache-aside TTL (time to live)Rate limiting
Cache-aside: The application checks the cache first, on a miss loads from the database and populates the cache, and invalidates or updates on writes. It is what Spring's @Cacheable does; the hard part is invalidation and stale data. See also: Write-through cache Cache stampede TTL (time to live)
Canary release: Send a small percentage of traffic to the new version, watch error rate and latency, then ramp up or roll back. It only works if you have per-version metrics and automated rollback criteria. See also: Blue/green deployment SLO (Service Level Objective)Observability
CAP theorem: During a network partition a distributed store must choose between consistency and availability; it cannot have both. It is a statement about behaviour under partition, not a menu of three picks at all times. See also: Eventual consistency Replication lag Sharding
CAS (compare-and-swap): An atomic CPU instruction that updates a value only if it still equals an expected one; it underpins AtomicInteger, ConcurrentHashMap and lock-free structures. Under heavy contention the retry loop burns CPU, so prefer LongAdder for hot counters. See also: volatile Race condition Happens-before
Circuit breaker: Stops calling a failing dependency after an error threshold, failing fast for a cool-off period before probing again (Resilience4j in the Spring world). It prevents slow downstream calls from exhausting your threads; pair it with timeouts and fallbacks. See also: Backpressure Rate limiting Thread pool
Circular dependency: Bean A needs B and B needs A, which constructor injection cannot satisfy; Spring Boot 2.6+ fails at startup rather than hiding it. Fix the design by extracting a third component or an event, not by enabling allow-circular-references. See also: DI (Dependency Injection)Bean IoC (Inversion of Control)
ClassLoader: The component that finds .class files and defines classes in the JVM, arranged in a parent-delegation hierarchy. The same class loaded by two loaders is two different types, which causes baffling ClassCastExceptions in app servers and plugin systems. See also: Bytecode Metaspace Proxy
Connection pool: A reusable set of open database connections, HikariCP in Spring Boot by default. Size it small (often 10-20 per instance) because the database, not your app, is the bottleneck, and remember that instances multiplied by pool size must stay under the DB connection limit. See also: Thread pool Backpressure ORM (Object-Relational Mapping)
Consistent hashing: Maps keys and nodes onto a ring so that adding or removing a node only moves a small fraction of keys, unlike hash % N which remaps almost everything. Used by distributed caches and partitioned stores, usually with virtual nodes for even load. See also: Sharding Cache-aside Replication lag
CORS: A browser mechanism where a server declares which other origins may call it from JavaScript, through Access-Control-Allow-* headers. It protects browsers only, not the server, and allowedOrigins("*") combined with credentials is not allowed. See also: CSRF (Cross-Site Request Forgery)API gateway JWT (JSON Web Token)
Covering index: An index that contains every column a query needs, so the database answers from the index alone without touching the table (an index-only scan). Add trailing columns with INCLUDE (PostgreSQL) for hot read queries, but each extra column slows writes. See also: Database index N+1 query problem ORM (Object-Relational Mapping)
CQRS: Command Query Responsibility Segregation: use separate models (and often stores) for writes and reads, so each is optimised independently. It adds sync complexity and eventual consistency, so use it only where read and write needs truly diverge. See also: Event sourcing Eventual consistency Replication lag
CSRF (Cross-Site Request Forgery): A malicious site makes the victim's browser send an authenticated request using its cookies. Spring Security enables CSRF tokens by default for session-based apps; it can be disabled for stateless APIs that use bearer tokens in a header, not cookies. See also: CORS JWT (JSON Web Token)OAuth 2.0
Database deadlock: Two transactions each hold row locks the other needs, and the database aborts one with a deadlock error. Update rows in a consistent order, keep transactions short, and be ready to retry the victim. See also: Deadlock Pessimistic locking Isolation level
Database index: A sorted structure (usually a B-tree) that lets the database find rows without scanning the table, at the cost of slower writes and extra storage. Column order in a composite index matters, and wrapping a column in a function in the WHERE clause usually defeats it; check with EXPLAIN. See also: Covering index ORM (Object-Relational Mapping)Schema migration
Deadlock: Two or more threads each hold a lock the other needs, so none ever proceeds. Acquire locks in a consistent global order and take a jstack thread dump, which reports detected deadlocks explicitly. See also: Race condition Database deadlock Thread pool
DI (Dependency Injection): Supplying an object's collaborators from outside, usually through the constructor. Prefer constructor injection: dependencies become final, required and testable without Spring, and field @Autowired hides them. See also: IoC (Inversion of Control)Bean Circular dependency
Dirty checking: Hibernate snapshots managed entities and, at flush time, automatically issues UPDATEs for any that changed, so no explicit save is needed inside a transaction. The surprise: mutating a loaded entity for display purposes persists the change. See also: First-level cache ORM (Object-Relational Mapping)@Transactional propagation
DLQ (dead-letter queue): A side queue where messages land after repeated processing failures, so one poison message does not block the stream. Monitor and alert on its depth, and keep enough context to replay messages after the bug is fixed. See also: At-least-once delivery Idempotency key Backpressure
Escape analysis: A JIT optimisation that proves an object never leaves a method or thread, so it can be allocated on the stack or eliminated entirely (scalar replacement) and its locks removed. It is why small short-lived objects are cheaper than they look, but it silently stops working once the object is stored in a field or passed to code that is not inlined. See also: JIT compiler (just-in-time)Heap Immutable object
Event sourcing: Store an append-only log of state-changing events and derive current state by replaying them, which gives a full audit trail and time travel. The costs are event schema versioning, snapshots for long streams and eventual-consistent read models. See also: CQRS Eventual consistency Transactional outbox
Eventual consistency: Replicas or services may disagree briefly but converge if updates stop. Design the UI and APIs for it, for example read-your-own-writes from the primary right after a write. See also: CAP theorem Replication lag Saga
Exactly-once processing: Each message has its effect precisely once. In practice it is at-least-once delivery plus idempotent handling or transactional writes (Kafka transactions work only within Kafka), not a magic broker property. See also: At-least-once delivery Idempotency key Transactional outbox
First-level cache: The per-session (persistence context) identity map: loading the same id twice in one transaction returns the same instance without a second query. It is not shared across requests, and it grows unbounded in big batch jobs unless you flush() and clear(). See also: Dirty checking N+1 query problem ORM (Object-Relational Mapping)
G1 (Garbage-First collector): The default GC since Java 9. It splits the heap into regions and collects the most garbage-filled ones first, aiming for a pause target set by -XX:MaxGCPauseMillis. A good general-purpose choice; huge allocations (humongous objects) are its classic gotcha. See also: ZGC Stop-the-world (STW)Heap
Graceful shutdown: On SIGTERM, stop accepting new requests, finish in-flight ones, then exit. Enable with server.shutdown=graceful and align spring.lifecycle.timeout-per-shutdown-phase with the Kubernetes terminationGracePeriodSeconds. See also: Liveness vs readiness Blue/green deployment Thread pool
Happens-before: The Java Memory Model rule that guarantees writes by one action are visible to another, for example unlocking a monitor before a later lock of it, or a volatile write before a later read. Without a happens-before edge, a thread may legally see stale or reordered data. See also: Memory visibility volatile Race condition
Heap: The JVM memory region where all objects live, sized with -Xms/-Xmx and cleaned by the garbage collector. In containers, set -XX:MaxRAMPercentage so the heap leaves room for metaspace, thread stacks and native buffers, or the kernel OOM-kills the pod. See also: Metaspace G1 (Garbage-First collector)OutOfMemoryError (OOM)
HMAC: A keyed hash that proves a message came from someone holding the shared secret and was not altered, used for webhook signatures and HS256 JWTs. Compare signatures with a constant-time check such as MessageDigest.isEqual, not equals. See also: JWT (JSON Web Token)BCrypt OAuth 2.0
Idempotency key: A client-generated unique id sent with a request (commonly an Idempotency-Key header) so the server can recognise a retry and return the original result instead of repeating the effect. Store the key with a unique constraint, so a retried payment charges once. See also: At-least-once delivery Exactly-once processing Transactional outbox
Immutable object: An object whose state cannot change after construction (all fields final, no mutators), so it can be shared across threads with no locking. Java record types are the easiest way to model DTOs and value objects this way. See also: Race condition Memory visibility ThreadLocal
IoC (Inversion of Control): The framework, not your code, creates objects and wires them together and controls their lifecycle. In Spring this is the ApplicationContext, which makes components easy to replace and test. See also: DI (Dependency Injection)Bean Auto-configuration
Isolation level: How much concurrent transactions can see of each other: read committed, repeatable read, serializable. PostgreSQL defaults to read committed and MySQL InnoDB to repeatable read, so identical code can behave differently across databases. See also: MVCC (Multi-Version Concurrency Control)Phantom read Optimistic locking
JIT compiler (just-in-time): The JVM starts by interpreting bytecode, then compiles hot methods to optimised machine code at run time (C1, then C2). It explains why Java benchmarks need warm-up and why the first requests after a deploy are slower. See also: Bytecode Escape analysis ClassLoader
JWT (JSON Web Token): A signed token carrying claims (sub, exp, roles) that servers verify without a session lookup. The payload is only base64-encoded, not encrypted, so never put secrets in it; keep lifetimes short, since a stateless token cannot be revoked before exp. See also: OAuth 2.0 HMAC RBAC (Role-Based Access Control)
Lazy loading: Associations are fetched only when first accessed, through a proxy. Touching them after the session closes throws LazyInitializationException; the answer is to fetch what you need in the query, not to enable open-session-in-view. See also: N+1 query problem First-level cache ORM (Object-Relational Mapping)
Liveness vs readiness: Liveness answers whether the process is stuck and should be restarted; readiness answers whether it can take traffic right now. Do not put database checks in liveness, or a DB outage restarts every pod; Spring Boot exposes /actuator/health/liveness and /readiness. See also: Actuator Graceful shutdown Service discovery
Memory visibility: The question of when one thread's write becomes observable by another; CPU caches and compiler reordering mean it is not automatic. A plain boolean stop flag read in a loop may never be seen as changed unless it is volatile or guarded by a lock. See also: Happens-before volatile Race condition
Metaspace: Native (off-heap) memory holding class metadata, replacing PermGen since Java 8. It grows until the OS limit by default, so a classloader leak (for example repeated hot redeploys) shows up as OutOfMemoryError: Metaspace; cap it with -XX:MaxMetaspaceSize. See also: ClassLoader Heap OutOfMemoryError (OOM)
Multi-stage build: A Dockerfile with several FROM stages, building with a full JDK in one and copying only the jar into a slim JRE image in the last. It shrinks images and attack surface; use Spring Boot layered jars so dependency layers stay cached. See also: 12-factor app Blue/green deployment JIT compiler (just-in-time)
MVCC (Multi-Version Concurrency Control): The database keeps multiple row versions so readers see a consistent snapshot without blocking writers. The cost is old versions that must be vacuumed or purged, so very long-running transactions bloat storage. See also: Isolation level Phantom read Pessimistic locking
N+1 query problem: Loading N parent rows and then issuing one extra query per parent to fetch a lazy association, giving N+1 round trips. Fix it with JOIN FETCH, an @EntityGraph or batch fetching, and catch it by logging SQL statement counts in tests. See also: Lazy loading ORM (Object-Relational Mapping)First-level cache
OAuth 2.0: A framework for delegated authorisation: a client obtains an access token from an authorisation server to call a resource server. Use the authorization code flow with PKCE for user logins and never the deprecated implicit flow; OpenID Connect adds identity on top. See also: JWT (JSON Web Token)RBAC (Role-Based Access Control)CSRF (Cross-Site Request Forgery)
Observability: The ability to understand internal behaviour from outputs: metrics, logs and traces. In Spring Boot 3 use Micrometer plus OpenTelemetry tracing, and propagate a trace id through logs so one request can be followed across services. See also: Structured logging SLO (Service Level Objective)Actuator
Optimistic locking: Detects concurrent edits by comparing a @Version column on update and failing with OptimisticLockException if it changed. No DB locks are held, so it scales well when conflicts are rare; handle the exception with a retry or a user-facing message. See also: Pessimistic locking Isolation level Race condition
ORM (Object-Relational Mapping): Maps tables to objects so you work with entities rather than SQL; JPA is the spec and Hibernate 6 the implementation. Convenient for CRUD, but it hides queries, so always inspect the generated SQL for hot paths. See also: N+1 query problem Dirty checking Lazy loading
OutOfMemoryError (OOM): Thrown when the JVM cannot allocate: heap exhausted, metaspace full, or unable to create a native thread. Always run production with -XX:+HeapDumpOnOutOfMemoryError so you can find the leak afterwards; do not just raise -Xmx. See also: Heap Metaspace Thread pool
Pessimistic locking: Takes a database row lock up front (SELECT ... FOR UPDATE, LockModeType.PESSIMISTIC_WRITE) so others wait. Use it for high-contention rows like stock counters, keep the transaction short, and set a lock timeout to avoid pile-ups. See also: Optimistic locking Database deadlock Isolation level
Phantom read: Re-running a range query in the same transaction returns new rows inserted and committed by someone else. Only serializable (or gap locks in MySQL) fully prevents it, which matters for checks like 'no overlapping bookings'. See also: Isolation level MVCC (Multi-Version Concurrency Control)Pessimistic locking
Profile: A named configuration slice (dev, prod) activated with spring.profiles.active to switch beans and properties per environment. Keep secrets out of profile files and prefer environment variables so the same artifact runs everywhere. See also: 12-factor app Auto-configuration Bean
Proxy: A generated wrapper around a bean that intercepts calls to add behaviour such as transactions, caching or security (JDK dynamic proxy or CGLIB subclass). Gotcha: a self-invocation (this.other()) skips the proxy, so @Transactional on that inner call is silently ignored. See also: AOP (Aspect-Oriented Programming)@Transactional propagation Bean
Race condition: A bug where the result depends on the timing of unsynchronised threads, such as check-then-act on a shared HashMap. Fix by confining state, using immutable objects, or using atomics, locks or concurrent collections. See also: Happens-before Immutable object CAS (compare-and-swap)
Rate limiting: Capping how many requests a client may make in a time window to protect services from abuse and overload, responding with HTTP 429 and Retry-After. Apply at the gateway for coarse limits and per-user in the app, backed by a shared store like Redis when running multiple instances. See also: Token bucket API gateway Backpressure
RBAC (Role-Based Access Control): Permissions are granted to roles and roles to users, enforced in Spring with @PreAuthorize("hasRole('ADMIN')") or URL rules. Enforce on the server for every request, and check object ownership too, otherwise users can read each other's records by changing an id. See also: JWT (JSON Web Token)OAuth 2.0 AOP (Aspect-Oriented Programming)
Replication lag: The delay before a write on the primary appears on a read replica. Reading from a replica right after writing can return stale data, so route such reads to the primary or use session stickiness. See also: Eventual consistency CAP theorem Sharding
Saga: A way to keep data consistent across services without a distributed transaction: a sequence of local transactions, each with a compensating action to undo it on failure. Coordinate by choreography (events) or orchestration (a central coordinator). See also: Transactional outbox Eventual consistency Idempotency key
Schema migration: Versioned, ordered scripts (Flyway, Liquibase) that evolve the database schema alongside code. Never rely on ddl-auto=update in production, and make changes backward compatible (expand, then contract) so old and new app versions can run together during a rollout. See also: Database index Blue/green deployment ORM (Object-Relational Mapping)
Service discovery: How services find the current network addresses of each other as instances come and go, via a registry (Eureka, Consul) or the platform itself (Kubernetes DNS and Services). On Kubernetes, use plain Service names and skip a separate registry. See also: API gateway Liveness vs readiness Circuit breaker
Sharding: Splitting data horizontally across databases by a shard key. A poor key creates hot shards, and cross-shard joins and transactions become hard, so exhaust indexing, caching and read replicas first. See also: Consistent hashing Replication lag CAP theorem
SLO (Service Level Objective): A target for a measured indicator, such as 99.9% of requests under 300 ms over 30 days; the gap to 100% is your error budget. Alert on budget burn rate rather than on every spike. See also: Observability Canary release Circuit breaker
Starter: A dependency descriptor such as spring-boot-starter-web that pulls in a curated, version-aligned set of libraries and triggers their auto-configuration. Align versions through the Boot BOM rather than pinning individual transitive versions. See also: Auto-configuration Bean Actuator
Stop-the-world (STW): A pause during which the JVM halts all application threads, for example for GC phases or safepoint operations. Long STW pauses appear as latency spikes and failed health checks; read them from the GC log (-Xlog:gc*). See also: G1 (Garbage-First collector)ZGC Heap
Structured logging: Emitting logs as machine-parseable JSON with fields (traceId, userId, level) instead of free text. Spring Boot 3.4 supports it natively; never log secrets or full request bodies. See also: Observability 12-factor app ThreadLocal
Thread pool: A fixed set of reusable worker threads fed by a queue (ExecutorService). An unbounded queue hides overload until you run out of memory, and a pool that blocks on tasks it submitted to itself can starve into deadlock; always bound both. See also: Virtual thread Backpressure Deadlock
ThreadLocal: Gives each thread its own copy of a variable, often used to carry a request context or user. In thread pools you must remove() it or values leak into the next request; with virtual threads prefer scoped values or explicit parameters. See also: Thread pool Virtual thread Memory visibility
Token bucket: A rate-limiting algorithm: tokens refill at a steady rate into a bucket of fixed capacity and each request spends one. It allows short bursts up to the bucket size while enforcing the long-run average; Bucket4j implements it for Java. See also: Rate limiting API gateway Backpressure
Transactional outbox: Write the business change and an event row in the same local database transaction, then have a relay (poller or CDC such as Debezium) publish it. This avoids the dual-write bug where the DB commits but the message broker call fails. See also: At-least-once delivery Saga Idempotency key
TTL (time to live): How long a cached entry, token or record stays valid before it expires. Add random jitter so many keys written together do not expire together, and pick it from how stale a value can safely be. See also: Cache-aside Cache stampede JWT (JSON Web Token)
Virtual thread: A lightweight JVM-scheduled thread (final in Java 21) that lets you write blocking code and still serve hundreds of thousands of concurrent tasks. Enable in Spring Boot 3.2+ with spring.threads.virtual.enabled=true; avoid pinning by long synchronized blocks around blocking I/O and do not pool them. See also: Thread pool ThreadLocal Deadlock
volatile: A field modifier that makes writes immediately visible to other threads and forbids reordering around the access. It does not make compound actions atomic: count++ on a volatile int is still a race. See also: Memory visibility Happens-before CAS (compare-and-swap)
Write-through cache: Writes go to the cache and the backing store together, so reads from the cache are never stale from your own writes. It costs write latency and caches data that may never be read. See also: Cache-aside TTL (time to live)Cache stampede
ZGC: A low-latency collector that does almost all work concurrently, keeping pauses well under a millisecond even on multi-terabyte heaps. Enable with -XX:+UseZGC (generational by default in recent JDKs) when tail latency matters more than raw throughput. See also: G1 (Garbage-First collector)Stop-the-world (STW)Heap