Application Properties

How Spring Boot's Configuration System Works

Spring Boot's configuration system is built on Spring's Environment abstraction — a unified view over a prioritised list of property sources. When you ask for server.port, the Environment walks that list from highest to lowest priority and returns the first value it finds. The source that provides it (a .properties file, an environment variable, a command-line argument) is transparent to the code consuming it.

This is what makes twelve-factor-style configuration possible: the same application binary reads from a properties file in development, from environment variables in a container, and from a secrets manager in production — no code changes, only the active property sources differ.

Configuration File Formats

# application.properties — flat key/value
server.port=8080
server.servlet.context-path=/api

spring.datasource.url=jdbc:postgresql://localhost:5432/mydb
spring.datasource.username=dbuser
# spring.datasource.password — see the secrets note below, NOT here in plain text

spring.jpa.hibernate.ddl-auto=validate   # NEVER create/update in production
spring.jpa.open-in-view=false            # recommended; see Spring Data JPA page

logging.level.root=INFO
logging.level.com.example=DEBUG

app.name=My Application
app.max-connections=100

# application.yml — YAML format, identical semantics, just hierarchical
server:
  port: 8080

spring:
  datasource:
    url: jdbc:postgresql://localhost:5432/mydb
    username: dbuser
  jpa:
    hibernate:
      ddl-auto: validate
    open-in-view: false

app:
  name: My Application
  max-connections: 100

Property Source Priority — What Overrides What

Spring Boot evaluates property sources in a fixed order. A source higher in this list (lower number = higher priority) shadows any value for the same key in a lower-priority source:

# Override via command-line — highest priority, wins over everything including env vars
java -jar app.jar --server.port=9090

# Override via environment variable — dots become underscores, uppercase
# spring.datasource.url → SPRING_DATASOURCE_URL
export SPRING_DATASOURCE_URL=jdbc:postgresql://prod-host:5432/proddb
java -jar app.jar

Accessing Properties in Code

@Value — for a single property in any bean

@Component
public class MyService {

    @Value("${app.name}")
    private String appName;

    @Value("${app.max-connections:50}")  // :50 is the default if key is absent
    private int maxConnections;
}

@ConfigurationProperties — type-safe binding for a group of related properties

// Modern idiom: a record with @ConfigurationProperties + @Validated
@ConfigurationProperties(prefix = "app")
@Validated  // fails at startup with a clear message if any constraint is violated
public record AppProperties(
    @NotBlank String name,
    @Min(1) @Max(1000) int maxConnections,
    @NotNull Security security
) {
    public record Security(
        @NotBlank String secretKey,
        @Positive long tokenExpiry
    ) {}
}

# application.yml — maps directly to the record above
app:
  name: My Application
  max-connections: 100
  security:
    secret-key: "${APP_SECRET_KEY}"   # resolved from env var — NOT hardcoded here
    token-expiry: 3600000

// Enable scanning for @ConfigurationProperties records
@SpringBootApplication
@ConfigurationPropertiesScan
public class MyApp {
    public static void main(String[] args) {
        SpringApplication.run(MyApp.class, args);
    }
}

// Inject as any other bean
@Service
public class TokenService {
    private final AppProperties props;

    public TokenService(AppProperties props) { this.props = props; }

    public long tokenExpiry() { return props.security().tokenExpiry(); }
}

<!-- pom.xml — optional but highly recommended -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-configuration-processor</artifactId>
    <optional>true</optional>
</dependency>

Secrets — What Never Goes in a Properties File

The correct pattern at each environment level:

# What a properties file SHOULD contain for a secret:
spring.datasource.password=${DB_PASSWORD}

# The actual value lives in an environment variable, a Kubernetes Secret,
# or a secrets manager — never in this file.

Interview Questions