Spring Framework Spring Security & Testing 2

Question 1

What does CSRF stand for in Spring Security?

Accepted Answer

Cross-Site Request Forgery

Answer

CSRF (Cross-Site Request Forgery) is an attack where a malicious site tricks an authenticated user's browser into making unwanted requests to another site.

Question 2

How do you write a Spring MVC controller unit test that bypasses the full security filter chain?

Accepted Answer

@WebMvcTest with @WithMockUser

Answer

@WebMvcTest loads only the web layer and @WithMockUser (from Spring Security Test) injects a mock authenticated user into the SecurityContext.

Question 3

What is the purpose of Spring Security's SecurityContextHolder?

Accepted Answer

Stores the currently authenticated user's details throughout a request

Answer

SecurityContextHolder stores the SecurityContext (which contains the Authentication object) for the current thread, making the user's identity available throughout the request lifecycle.

Question 4

Which Spring Security filter is responsible for processing form-based username/password login?

Accepted Answer

UsernamePasswordAuthenticationFilter

Answer

UsernamePasswordAuthenticationFilter intercepts login form submissions, extracts credentials, and delegates to an AuthenticationManager for validation.

Question 5

What annotation in Spring Security Test gives a test method a custom user with specific roles?

Accepted Answer

@WithMockUser

Answer

@WithMockUser populates the SecurityContext with a mock user, configurable with username, roles, and authorities, without requiring actual authentication.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Spring Security & Testing 2