Spring Boot Spring Security Fundamentals 3 — Questions and Answers
Question 1: Which Spring Security class is used to configure HTTP security using the fluent API in a SecurityFilterChain bean?
- WebSecurityAdapter
- HttpSecurityConfig
- HttpSecurity (Correct answer)
- SecurityConfigurer
Correct answer: HttpSecurity
HttpSecurity provides a fluent API to configure security for HTTP requests, including authorization rules, login forms, CSRF settings, and session management.
Question 2: What is the role of an AuthenticationManager in Spring Security?
- It stores authenticated users in the database
- It processes authentication requests and returns an Authentication object (Correct answer)
- It generates JWT tokens for authenticated users
- It manages the HTTP session lifecycle
Correct answer: It processes authentication requests and returns an Authentication object
AuthenticationManager is the core interface for processing authentication; its authenticate() method accepts an Authentication request and returns a fully populated Authentication object if successful.
Question 3: In Spring Security, what does the hasRole() expression automatically prepend to the role name?
- ROLE_ (Correct answer)
- AUTH_
- GRANT_
- PERM_
Correct answer: ROLE_
hasRole('ADMIN') is equivalent to hasAuthority('ROLE_ADMIN') — Spring Security automatically prepends 'ROLE_' when using hasRole() expressions.
Question 4: Which filter in the Spring Security filter chain is responsible for reading the JWT token from the request header?
- UsernamePasswordAuthenticationFilter
- OncePerRequestFilter (custom) (Correct answer)
- BasicAuthenticationFilter
- SecurityContextPersistenceFilter
Correct answer: OncePerRequestFilter (custom)
JWT extraction is typically done in a custom filter that extends OncePerRequestFilter, which guarantees the filter logic runs exactly once per request.
Question 5: What is the purpose of the @Secured annotation in Spring Security?
- It marks a class as a security configuration
- It restricts method access to users with specified roles (Correct answer)
- It encrypts the annotated field value
- It enables HTTPS for the annotated endpoint
Correct answer: It restricts method access to users with specified roles
@Secured restricts method invocation to users who have at least one of the listed roles (e.g., @Secured('ROLE_ADMIN')), and requires @EnableMethodSecurity(securedEnabled=true).
Question 6: How does Spring Security's session fixation protection work by default?
- It invalidates all sessions on every request
- It creates a new session and copies attributes after authentication (Correct answer)
- It uses cookies with SameSite=Strict to prevent fixation
- It requires re-authentication on every new session
Correct answer: It creates a new session and copies attributes after authentication
By default, Spring Security uses the 'changeSessionId' strategy (or 'migrateSession' in older versions) to create a new session ID after authentication while preserving session attributes.
Question 7: Which Spring Security component is responsible for converting a successful authentication into a granted authority list?
- GrantedAuthorityConverter
- AuthoritiesPopulator
- GrantedAuthoritiesMapper (Correct answer)
- RoleHierarchyImpl
Correct answer: GrantedAuthoritiesMapper
GrantedAuthoritiesMapper maps the collection of GrantedAuthority objects after authentication, allowing you to add, remove, or transform authorities before they are stored in the SecurityContext.
Spring Boot Spring Security Fundamentals 3
Which Spring Security class is used to configure HTTP security using the fluent API in a SecurityFilterChain bean?