Spring Boot Spring Security Fundamentals 4 — Questions and Answers
Question 1: When using OAuth2 Resource Server in Spring Boot, which annotation on the controller method restricts access to valid JWT bearers only?
- @BearerOnly
- @OAuth2Protected
- @PreAuthorize("isAuthenticated()") (Correct answer)
- @Secured("SCOPE_read")
Correct answer: @PreAuthorize("isAuthenticated()")
With an OAuth2 resource server configured, @PreAuthorize("isAuthenticated()") ensures only requests with a valid Bearer token can access the method; scope checks use hasAuthority('SCOPE_xxx').
Question 2: What is CORS and why must it be configured in Spring Security?
- A caching strategy for REST APIs that Spring Security manages by default
- A browser security mechanism that blocks cross-origin requests unless the server explicitly allows them (Correct answer)
- A token format used in Spring Security OAuth2 flows
- A method for encrypting HTTP headers in transit
Correct answer: A browser security mechanism that blocks cross-origin requests unless the server explicitly allows them
CORS (Cross-Origin Resource Sharing) is enforced by browsers and requires the server to include Access-Control-Allow-Origin headers; Spring Security must be configured to allow CORS before its filters block preflight requests.
Question 3: What does the permitAll() method do when configuring URL-based authorization in Spring Security?
- Grants access to all authenticated users regardless of role
- Allows unauthenticated requests to access the matched URLs (Correct answer)
- Bypasses the entire filter chain for matched URLs
- Disables CSRF protection for matched URLs
Correct answer: Allows unauthenticated requests to access the matched URLs
permitAll() allows any request—authenticated or not—to access the matched path, making it suitable for public endpoints like login pages, registration, and static resources.
Question 4: Which Spring Security feature allows you to define a hierarchy where ROLE_ADMIN automatically includes ROLE_USER privileges?
- RoleInheritance
- RoleHierarchy (Correct answer)
- AuthorityChain
- SecurityRoleMap
Correct answer: RoleHierarchy
RoleHierarchy (implemented by RoleHierarchyImpl) lets you define role inheritance so that a higher role automatically includes all privileges of lower roles.
Question 5: In a Spring Boot application, what is the default session creation policy for stateless REST APIs?
- ALWAYS
- IF_REQUIRED
- STATELESS (Correct answer)
- NEVER
Correct answer: STATELESS
For stateless REST APIs (e.g., JWT-based), SessionCreationPolicy.STATELESS should be set so Spring Security never creates or uses an HTTP session, ensuring true statelessness.
Question 6: What is the difference between @PostAuthorize and @PreAuthorize in Spring Security?
- @PostAuthorize checks roles; @PreAuthorize checks permissions
- @PostAuthorize runs after method execution and can access the return value; @PreAuthorize runs before (Correct answer)
- @PostAuthorize is for REST; @PreAuthorize is for MVC controllers
- @PostAuthorize logs the result; @PreAuthorize logs the input
Correct answer: @PostAuthorize runs after method execution and can access the return value; @PreAuthorize runs before
@PostAuthorize evaluates the SpEL expression after the method runs, with access to returnObject, making it useful for object-level authorization based on the returned data.
Question 7: Which property in application.properties enables Spring Security's debug logging for the filter chain?
- spring.security.debug=true
- logging.level.org.springframework.security=DEBUG (Correct answer)
- spring.security.filter.log=true
- debug.security.enabled=true
Correct answer: logging.level.org.springframework.security=DEBUG
Setting logging.level.org.springframework.security=DEBUG in application.properties enables verbose logging of Spring Security's filter chain, authentication events, and access decisions.
Spring Boot Spring Security Fundamentals 4
When using OAuth2 Resource Server in Spring Boot, which annotation on the controller method restricts access to valid JWT bearers only?