Trainer guide & classroom plan
Use the three implementations as a connected course, with a clear demo sequence and measurable outcomes.
Optional prerequisite days · Java web basics
For students who know Core Java but have not used Servlets or JSP, teach Manual 00 before Day 1 of the Spring plan. Reserve 1–2 days (8–12 hours): HTML/HTTP and Tomcat setup; first Servlet and request inspection; JSP/EL/JSTL; session-backed CRUD; filters, validation, and the transition to Spring.
Completion criteria: each student deploys the WAR, performs CRUD, demonstrates independent sessions, and explains parameters versus attributes and forward versus redirect. Students already competent in these areas can skip this prerequisite.
1. Suggested 5-day delivery plan
| Day | Topics and demonstrations | Learner output |
|---|---|---|
| 1 · 6 hours | Tool setup; Spring versus Boot; IoC and beans; constructor injection; request lifecycle; Atlas setup | Trace a request and establish an Atlas connection. |
| 2 · 6 hours | Manual 01; document and repository; service; controller; templates; validation and CSRF; persistent CRUD | Working Thymeleaf app and a field-extension exercise. |
| 3 · 6 hours | Manual 02; HTTP contracts; DTOs; JSON conversion; errors; Postman variables and assertions | Working REST API plus successful negative tests. |
| 4 · 6 hours | Manual 03 backend; password hashing; JWT issuance and verification; ownership; CORS/CSRF distinctions | Alice/Bob API isolation proved in Postman. |
| 5 · 6 hours | React state and events; fetch; token lifetime; UI CRUD; full verification; deployment discussion | Personal todo frontend and final demonstration. |
2. Prepare before learners arrive
- Extract the bundle and open index.html locally.
- Verify JDK and Maven using their version commands. Verify Node for Day 5.
- Create your Atlas database user and IP rule. Set credentials in your launch terminal.
- Start each backend once to download dependencies and verify its actual database operations.
- Run npm install and npm run build in the React folder before class to discover proxy/network problems early.
- Import Postman collections and the environment. Run them against the local APIs.
- Keep a clean training database or use unique account emails for repeated demos.
- Use your own database URI privately; display only placeholder configuration on a projector.
Source and documents are ready to use. First-time downloads and actual Atlas provisioning are environment-specific, so reserve setup time.
3. Demonstrate one feature across three versions
Use “Prepare training slides” as the same example task throughout the course. First create it through a Thymeleaf form, then create it through Postman JSON, then create it through React with Alice’s bearer token. At each stage, inspect the HTTP request and stored document.
For MVC, show the generated HTML and hidden CSRF field. For REST, show Content-Type, 201, Location, and the DTO. For JWT, show the request header and explain why decoding the payload does not establish trust. Finally attempt Alice’s id using Bob’s token and show 404.
When demonstrating code, follow controller → service → repository once, then return to the user-visible behavior. Learners should connect annotations to runtime behavior rather than memorize them in isolation.
4. Exercises and completion criteria
| Exercise | Acceptance criteria |
|---|---|
| Add description to MVC | Description binds, validates to 500 characters, persists, and displays escaped. |
| Add completed filter to REST | GET filter returns only matching tasks; invalid query values are handled; existing CRUD still works. |
| Explain and prove ownership | Bob cannot read, change, or delete Alice’s id; Alice’s data remains unchanged. |
| React usability extension | Display remaining token lifetime and friendly network feedback without persisting the token. |
| Optional pagination | Responses are bounded, page inputs are validated, and personal queries keep ownerId. |
| Optional optimistic locking | Two stale edits produce a conflict rather than silently replacing the latest change. |
5. Assessment questions with answer notes
- What makes a class a Spring bean? Registration in the ApplicationContext through scanning, @Bean, or another supported registration mechanism.
- Why constructor injection? It makes required dependencies explicit and supports immutable references and isolated tests.
- What does Boot configure automatically? Infrastructure selected by dependencies, properties, and existing beans; it does not write business rules.
- Why use a request DTO? It restricts writable fields and separates API shape from storage.
- Why does @Valid matter? Constraints are metadata until a validation entry point evaluates them.
- How does Thymeleaf differ from React? Thymeleaf renders HTML on the backend; React renders the interactive interface in the browser.
- What is the difference between authentication and authorization? Identity verification versus deciding which resource operations are allowed.
- Is a JWT encrypted? This JWT is signed; header and payload are readable. The signature supplies integrity and authenticity.
- Why does a unique email index matter? Application checks alone can race; the database index enforces uniqueness.
- Does React logout revoke copied tokens? No. This lab clears local state; copied tokens remain usable until expiration.
- Why can Postman succeed when React fails? Browser CORS policy does not apply to Postman.
- Why must each personal query include ownerId? Hiding data in the UI is insufficient authorization.
6. Final demonstration rubric
A learner completes the program when they can run all projects, perform persistent CRUD, explain the Spring bean graph and request lifecycle, show correct REST status codes, demonstrate server validation, register and sign in, and prove two-user isolation. They should also state the JWT lifetime and logout limitations accurately.
Suggested grading: implementation and persistence 30%; request/response explanation 20%; validation and errors 15%; authentication and ownership 25%; clean setup and explanation of practical limits 10%.