Spring Framework Spring Security & Testing 1 — Questions and Answers
Question 1: What is the default login URL provided by Spring Security's form login feature?
- /auth/login
- /spring/login
- /login (Correct answer)
- /user/login
Correct answer: /login
Spring Security auto-generates a /login page when form login is enabled and no custom login page is configured.
Question 2: Which annotation enables Spring Security's method-level security?
- @EnableMethodSecurity (Correct answer)
- @EnableGlobalSecurity
- @EnableWebSecurity
- @EnableSecureMethods
Correct answer: @EnableMethodSecurity
@EnableMethodSecurity (Spring Security 5.6+) activates method-level annotations like @PreAuthorize, @PostAuthorize, and @Secured.
Question 3: What does the @PreAuthorize annotation do in Spring Security?
- Encrypts method parameters before execution
- Evaluates a SpEL expression before a method is invoked to check authorization (Correct answer)
- Pre-fetches user credentials from the database
- Caches method results for authorized users
Correct answer: Evaluates a SpEL expression before a method is invoked to check authorization
@PreAuthorize evaluates a Spring Expression Language (SpEL) authorization expression before the target method executes, denying access if it returns false.
Question 4: In Spring Security, what is a GrantedAuthority?
- A permission or role assigned to a user (Correct answer)
- An OAuth2 access token
- An authentication provider
- A CSRF protection token
Correct answer: A permission or role assigned to a user
GrantedAuthority represents a permission or role (e.g., ROLE_ADMIN) granted to a principal, used in access control decisions.
Question 5: What Spring Security class is used to encode passwords before storing them?
- PasswordEncoder (Correct answer)
- BCryptEncoder
- PasswordHasher
- CryptoService
Correct answer: PasswordEncoder
PasswordEncoder is the interface Spring Security uses for one-way password encoding; BCryptPasswordEncoder is the recommended implementation.
Question 6: What HTTP status does Spring Security return by default when an unauthenticated user accesses a protected resource?
- 403 Forbidden
- 404 Not Found
- 401 Unauthorized
- 302 Redirect to login (Correct answer)
Correct answer: 302 Redirect to login
By default, Spring Security redirects unauthenticated users to the login page (HTTP 302) rather than returning a 401 directly.
Spring Framework Spring Security & Testing 1
What is the default login URL provided by Spring Security's form login feature?