Spring Boot Spring Security Fundamentals 5 — Questions and Answers
Question 1: What is the purpose of the DelegatingFilterProxy in Spring Security?
- It proxies database calls through a security layer
- It bridges the Servlet container's filter lifecycle with Spring's ApplicationContext to delegate to a Spring-managed filter bean (Correct answer)
- It routes requests to different authentication providers based on URL patterns
- It delegates password encoding to the configured PasswordEncoder
Correct answer: It bridges the Servlet container's filter lifecycle with Spring's ApplicationContext to delegate to a Spring-managed filter bean
DelegatingFilterProxy is a standard Servlet Filter that looks up a Spring bean (typically FilterChainProxy) from the ApplicationContext and delegates all filter work to it.
Question 2: How do you configure Basic Authentication in a Spring Boot 3.x SecurityFilterChain?
- Add @EnableBasicAuth to the configuration class
- Call http.httpBasic(Customizer.withDefaults()) in the SecurityFilterChain bean (Correct answer)
- Set spring.security.basic.enabled=true in application.properties
- Annotate the controller with @BasicAuthRequired
Correct answer: Call http.httpBasic(Customizer.withDefaults()) in the SecurityFilterChain bean
In Spring Boot 3.x with the lambda DSL, http.httpBasic(Customizer.withDefaults()) enables HTTP Basic authentication with default settings in the SecurityFilterChain.
Question 3: What is the SecurityContext and where is it stored by default in a web application?
- It is a configuration file stored in the classpath
- It holds the Authentication object and is stored in the HTTP session by default (Correct answer)
- It is a database table that Spring Security manages automatically
- It is stored in a browser cookie encrypted with AES
Correct answer: It holds the Authentication object and is stored in the HTTP session by default
The SecurityContext holds the current Authentication and is stored in the HTTP session by default via HttpSessionSecurityContextRepository, making it available across requests.
Question 4: Which Spring Security class provides in-memory user storage for development and testing purposes?
- MockUserDetailsService
- InMemoryUserDetailsManager (Correct answer)
- StaticUserStore
- TestUserRepository
Correct answer: InMemoryUserDetailsManager
InMemoryUserDetailsManager implements UserDetailsService and UserDetailsManager to store and manage user details entirely in memory, suitable for prototyping and tests.
Question 5: What does the antMatcher (or requestMatchers in Spring Security 6) method do in an HttpSecurity configuration?
- It applies the security configuration only to requests matching the specified pattern (Correct answer)
- It blocks all requests that do not match the pattern
- It enables anti-CSRF protection for matched URLs
- It assigns roles to matching URL patterns automatically
Correct answer: It applies the security configuration only to requests matching the specified pattern
requestMatchers() (the Spring Security 6+ replacement for antMatcher) scopes the security rules that follow to only the HTTP requests whose paths match the given pattern.
Question 6: Which event is published by Spring Security when a user successfully authenticates?
- AuthenticationCreatedEvent
- UserLoggedInEvent
- AuthenticationSuccessEvent (Correct answer)
- SecurityGrantedEvent
Correct answer: AuthenticationSuccessEvent
Spring Security publishes AuthenticationSuccessEvent (and its subclass InteractiveAuthenticationSuccessEvent for form login) via the ApplicationEventPublisher after successful authentication.
Question 7: What is the effect of calling http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated()) in a Spring Boot security configuration?
- It makes all endpoints publicly accessible
- It requires all incoming HTTP requests to be authenticated (Correct answer)
- It restricts all endpoints to users with ROLE_ADMIN
- It enables two-factor authentication for all requests
Correct answer: It requires all incoming HTTP requests to be authenticated
anyRequest().authenticated() is a catch-all rule that requires every request not matched by a more specific rule to have an authenticated principal, returning 401/403 otherwise.
Spring Boot Spring Security Fundamentals 5
What is the purpose of the DelegatingFilterProxy in Spring Security?