Spring Boot Spring Security Fundamentals 4

Question 1

When using OAuth2 Resource Server in Spring Boot, which annotation on the controller method restricts access to valid JWT bearers only?

Accepted Answer

@PreAuthorize("isAuthenticated()")

Answer

With an OAuth2 resource server configured, @PreAuthorize("isAuthenticated()") ensures only requests with a valid Bearer token can access the method; scope checks use hasAuthority('SCOPE_xxx').

Question 2

What is CORS and why must it be configured in Spring Security?

Accepted Answer

A browser security mechanism that blocks cross-origin requests unless the server explicitly allows them

Answer

CORS (Cross-Origin Resource Sharing) is enforced by browsers and requires the server to include Access-Control-Allow-Origin headers; Spring Security must be configured to allow CORS before its filters block preflight requests.

Question 3

What does the permitAll() method do when configuring URL-based authorization in Spring Security?

Accepted Answer

Allows unauthenticated requests to access the matched URLs

Answer

permitAll() allows any request—authenticated or not—to access the matched path, making it suitable for public endpoints like login pages, registration, and static resources.

Question 4

Which Spring Security feature allows you to define a hierarchy where ROLE_ADMIN automatically includes ROLE_USER privileges?

Accepted Answer

RoleHierarchy

Answer

RoleHierarchy (implemented by RoleHierarchyImpl) lets you define role inheritance so that a higher role automatically includes all privileges of lower roles.

Question 5

In a Spring Boot application, what is the default session creation policy for stateless REST APIs?

Accepted Answer

STATELESS

Answer

For stateless REST APIs (e.g., JWT-based), SessionCreationPolicy.STATELESS should be set so Spring Security never creates or uses an HTTP session, ensuring true statelessness.

Spring Boot Practice Test

Spring Boot Practice Test

Spring Boot Spring Security Fundamentals 4