惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

美团技术团队
P
Privacy International News Feed
P
Proofpoint News Feed
Security Archives - TechRepublic
Security Archives - TechRepublic
C
CXSECURITY Database RSS Feed - CXSecurity.com
Know Your Adversary
Know Your Adversary
Security Latest
Security Latest
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Attack and Defense Labs
Attack and Defense Labs
NISL@THU
NISL@THU
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
W
WeLiveSecurity
GbyAI
GbyAI
N
News and Events Feed by Topic
N
News | PayPal Newsroom
Y
Y Combinator Blog
C
CERT Recently Published Vulnerability Notes
N
Netflix TechBlog - Medium
S
Security Affairs
Spread Privacy
Spread Privacy
罗磊的独立博客
腾讯CDC
MyScale Blog
MyScale Blog
www.infosecurity-magazine.com
www.infosecurity-magazine.com
L
LINUX DO - 热门话题
The Cloudflare Blog
L
LangChain Blog
博客园_首页
H
Hacker News: Front Page
宝玉的分享
宝玉的分享
Martin Fowler
Martin Fowler
博客园 - 聂微东
SecWiki News
SecWiki News
A
Arctic Wolf
爱范儿
爱范儿
Google Online Security Blog
Google Online Security Blog
T
Threat Research - Cisco Blogs
Hacker News - Newest:
Hacker News - Newest: "LLM"
有赞技术团队
有赞技术团队
The GitHub Blog
The GitHub Blog
Cyberwarzone
Cyberwarzone
博客园 - 叶小钗
V
Visual Studio Blog
V
V2EX
T
Tailwind CSS Blog
Project Zero
Project Zero
T
The Blog of Author Tim Ferriss
F
Fortinet All Blogs
MongoDB | Blog
MongoDB | Blog
D
Docker

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Why I Still Believe in Zero-Cost BFF Layers After 6 Months (And What Broke)
KevinTen · 2026-06-25 · via DEV Community

Why I Still Believe in Zero-Cost BFF Layers After 6 Months (And What Broke)

Honestly, I didn't expect to be writing this article. Six months ago, I built capa-bff — a zero-cost BFF framework that won a hackathon gold medal — and I thought I had it all figured out. "This is perfect," I told myself. "Zero configuration, works with any Spring Boot app, solves all the frontend aggregation problems."

Spoiler alert: It didn't. Don't get me wrong — it's still great for what it is. But here's the thing about building developer tools: the real world has a way of humbling you. Let me walk you through what I learned, what works, what doesn't, and who should actually use this thing.


What Even Is a BFF Anyway?

If you're new to the term, BFF stands for Backend For Frontend. It's that intermediate layer between your frontend clients (web, mobile, mini-programs) and your backend services. The idea is simple: instead of making the frontend stitch together data from multiple backend APIs, you have this middle layer that does it for you.

┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│  Frontend   │ -> │    BFF      │ -> │  Backend    │
│  (Web/Mobile)│   │ Aggregation │   │  Services   │
└─────────────┘    └─────────────┘    └─────────────┘

The benefits are clear:

  • Fewer network calls from the client
  • Customized responses for each client type
  • Better caching opportunities
  • One place to handle auth/transformations

But here's the catch most articles don't tell you: adding a BFF layer means another service to maintain, another deployment, another thing that can break. For small teams and startups, that cost can feel too high.

That's exactly why I built capa-bff: I wanted a zero-cost BFF layer that you can just drop into your existing Spring Boot app. No new service, no extra deployment — just add the dependency and start aggregating APIs.

How It Actually Works (Code Example)

Let me show you the basics. With capa-bff, you define your aggregation in a simple annotation:

@BffRoute(path = "/user-dashboard")
public DashboardResponse getUserDashboard(
    @BffAggregate(service = "user-service", path = "/users/{userId}") 
    User user,

    @BffAggregate(service = "order-service", path = "/users/{userId}/recent-orders") 
    List<Order> recentOrders,

    @BffAggregate(service = "notification-service", path = "/users/{userId}/unread-count") 
    Integer unreadNotifications
) {
    return DashboardResponse.builder()
        .user(user)
        .recentOrders(recentOrders)
        .unreadNotifications(unreadNotifications)
        .build();
}

That's it. Capa-bff handles:

  • Parallel calls to all your backend services
  • Aggregation into one response
  • Caching if you want it
  • Error handling (partial failures still return what works)

Under the hood, it's just Spring WebClient doing parallel requests. No magic, no fancy distributed tracing that requires another 10 services to work. Just straightforward aggregation.

Here's what the dependency looks like in your pom.xml:

<dependency>
    <groupId>cloud.capa</groupId>
    <artifactId>capa-bff-starter</artifactId>
    <version>1.0.0</version>
</dependency>

And that's literally all you need. Add the starter, annotate your aggregation methods, and you're done. No extra config, no new ports, nothing. It runs inside your existing Spring Boot app.


The Good Stuff: What Actually Works

Okay, let's get into the real talk. After six months of using this in production (yes, it's actually running somewhere), what's working well?

1. It's truly zero-cost for small teams

This is what I'm most proud of. For a small team like mine (read: just me working on side projects), adding a BFF layer shouldn't mean spinning up another Kubernetes deployment, another CI/CD pipeline, another monitoring setup.

With capa-bff, I added BFF aggregation to an existing Spring Boot app in about 10 minutes. That's it. No infrastructure cost, no operational overhead.

Real performance numbers: On my modest VPS, it handles 5000+ QPS with response times between 50-100ms. That's more than enough for 99% of applications out there.

2. Parallel aggregation is a game-changer

Instead of the frontend making 3-4 sequential calls (each adding network latency), capa-bff makes them in parallel. So even if your backend services are slow, your total response time is basically the slowest service, not the sum.

Before:

User service: 100ms -> Orders: 80ms -> Notifications: 50ms
Total: 230ms latency

After (parallel with capa-bff):

All three call at once
Total: ~100ms latency

That's a huge win for perceived performance, especially on mobile where network latency is unpredictable.

3. It's surprisingly flexible for multi-client needs

One of the common BFF use cases is having different responses for web vs mobile vs mini-programs. With capa-bff, you just define different aggregation routes:

// Mobile version - lighter response, fewer fields
@BffRoute(path = "/mobile/home")
public MobileHomeResponse getMobileHome(...) { ... }

// Desktop version - full data
@BffRoute(path = "/desktop/dashboard") 
public DesktopDashboardResponse getDesktopDashboard(...) { ... }

Because it's just code, you can do whatever custom transformations you need. No YAML configuration hell, no DSL to learn. Just Java.

4. Caching is dead simple

Need to cache a frequent aggregation? Just add another annotation:

@BffCache(tTL = 300) // 5 minutes
@BffRoute(path = "/popular-products")
public List<Product> getPopularProducts() { ... }

It uses Spring Cache under the hood, so it works with whatever cache provider you already have — Caffeine, Redis, whatever. No new cache infrastructure to set up.


The Ugly Truth: What Broke and What I Didn't Expect

Okay, let's get into the part that nobody puts in their README. The hard lessons I learned the painful way.

1. Configuration still gets complex when you have many services

I said "zero configuration", but that's only partly true. You still need to tell capa-bff where your backend services are. For a handful of services, that's easy:

capa:
  bff:
    services:
      user-service: http://user-service:8080
      order-service: http://order-service:8081
      notification-service: http://notification-service:8082

But when you have 10+ services? That configuration file gets big. And if you're using service discovery (like Eureka or Nacos), you have to integrate that yourself. I didn't build in service discovery support because I wanted to keep it simple. That's a valid choice, but it's a limitation.

The lesson: Great for 2-10 services. If you have 20+ microservices, you probably want something with more out-of-the-box service discovery integration.

2. Error handling gets tricky when things fail

So here's the thing: when you aggregate multiple services in parallel, what happens when one fails?

I originally designed it to return partial results — if two services work and one fails, you still get the data from the two that worked. That's great for UX, right? The user still sees something instead of a blank screen.

But here's what I didn't think through: how does the frontend handle partial responses? Now your frontend has to deal with the fact that some fields might be missing. That adds complexity to the frontend code that you don't have when you just fail fast.

I learned the hard way that partial responses sound great in theory, but in practice, most frontends expect either everything or nothing. I ended up adding configurable error handling — you can choose between fail-fast vs partial. But that's more complexity I didn't expect.

3. Monitoring and observability are an afterthought

Because this runs inside your existing app, it inherits all the monitoring you already have. That's the good news. The bad news? There's no built-in BFF-specific observability.

Want to see how long each aggregated call takes per service? Want metrics about how often aggregations fail? You have to build that yourself. It's not hard — it's just Spring Boot, you can add your own metrics — but it's not there out of the box.

For a side project, that's fine. For a production system at scale, you probably want more baked-in observability.

4. It doesn't solve the "too many endpoints" problem

Wait, isn't that what BFF is supposed to solve? Let me explain.

If you have different clients (web, iOS, Android, mini-program, etc.), each needs different data. So you end up creating a different BFF endpoint for each client. That's fine — that's what BFF is for.

But over time, you can end up with dozens of BFF endpoints, each custom to a specific client screen. That's still better than the frontend doing all the aggregation, but it does mean you're still maintaining that code. I haven't found a good way around this yet — it's just the cost of doing BFF.

5. Memory usage can creep up if you're not careful

Because everything is in-process, if you cache a lot of aggregated responses, you're using your app's memory. If you're not careful with your TTLs and cache sizes, you can get memory bloat.

This is totally manageable — just use sensible cache settings and monitor your memory — but it's something to be aware of. If you expect huge cache sizes, you're better off using a dedicated remote cache like Redis anyway.


Pros & Cons: The Honest Breakdown

Let me make this simple for you. Here's the honest breakdown:

Pros

  1. Zero infrastructure cost — runs inside your existing Spring Boot app, no new service needed
  2. Dead simple to get started — add dependency, annotate, done. 10 minutes tops
  3. Parallel aggregation by default — huge latency win over sequential frontend calls
  4. Flexible — just code, so you can do any custom transformation you need
  5. Works with your existing Spring Boot setup — no forced architecture changes
  6. Good performance — 5000+ QPS on modest hardware is more than enough for most apps
  7. Built-in caching — drop-in caching with Spring Cache

Cons

  1. No built-in service discovery — you have to handle that yourself if you need it
  2. Configuration gets messy with many microservices
  3. Partial responses add frontend complexity — you have to handle missing data
  4. Limited observability out of the box — you need to add your own metrics
  5. In-process caching uses your app's memory — can cause bloat if misconfigured
  6. Opinionated and simple — if you need advanced features, you'll be disappointed

Who Should Actually Use This?

After six months, here's my take on when you should use capa-bff and when you should look elsewhere:

🎯 Use capa-bff when:

  • You're a small team or solo developer
  • You have an existing Spring Boot monolith or small number of services
  • You want BFF benefits without the operational overhead of another service
  • You need simple API aggregation quickly
  • You're building a MVP or prototype and want to move fast

🚫 Look elsewhere when:

  • You have a large microservices architecture with 20+ services
  • You need built-in service discovery out of the box
  • You need advanced observability and distributed tracing
  • You want to run your BFF as a separate service for scaling independently
  • You're not using Spring Boot (capa-bff is Spring Boot only)

What I'd Do Differently If I Built It Again

Honestly, I'm still pretty happy with the core idea. Zero-cost BFF for Spring Boot apps fills a real niche. But if I started over, here's what I'd change:

  1. Add service discovery integration — at least for the common ones like Eureka and Nacos
  2. Better built-in metrics — out-of-the-box Micrometer metrics for aggregation times, failure rates, etc.
  3. More flexible error handling strategies — better defaults for different scenarios
  4. Example project with proper observability — show people how to add monitoring

The good news is that it's open source, so contributions are welcome. If you find this useful and want to add any of these features, PRs are definitely appreciated.


Final Thoughts

Building capa-bff was an interesting journey. We won a hackathon gold medal with it, it's got 36 stars on GitHub (which is more than I expected for a niche tool), and people are actually using it.

But the real lesson for me wasn't about the code — it was about how "zero-cost" doesn't mean "zero-complexity". Every architectural choice has tradeoffs. Putting the BFF in-process saves you infrastructure cost, but it trades that for other tradeoffs. There's no free lunch.

Honestly, I still use it for my own projects. For my use case — small services, small team, need to move fast — it's perfect. The tradeoffs are worth it. But I also know it's not for everyone, and that's okay.

The project is on GitHub if you want to check it out. Star it if you find it interesting, open an issue if you have questions, and feel free to submit PRs if you want to improve it.


What's Your BFF Experience?

I'm curious — what's your take on BFF layers? Do you run them as separate services or embed them? Have you found any other good zero-cost approaches? Drop a comment below and let me know — I'd love to hear what's working for you.


This article is part of my series where I share the real lessons from building open source tools. You can check out more of my projects on GitHub.