Spring Security & Testing Flashcards

What does CSRF stand for in Spring Security?

Answer: Cross-Site Request Forgery

CSRF (Cross-Site Request Forgery) is an attack where a malicious site tricks an authenticated user's browser into making unwanted requests to another site.

How do you write a Spring MVC controller unit test that bypasses the full security filter chain?

Answer: @WebMvcTest with @WithMockUser

@WebMvcTest loads only the web layer and @WithMockUser (from Spring Security Test) injects a mock authenticated user into the SecurityContext.

What is the purpose of Spring Security's SecurityContextHolder?

Answer: Stores the currently authenticated user's details throughout a request

SecurityContextHolder stores the SecurityContext (which contains the Authentication object) for the current thread, making the user's identity available throughout the request lifecycle.

Which Spring Security filter is responsible for processing form-based username/password login?

Answer: UsernamePasswordAuthenticationFilter

UsernamePasswordAuthenticationFilter intercepts login form submissions, extracts credentials, and delegates to an AuthenticationManager for validation.

What annotation in Spring Security Test gives a test method a custom user with specific roles?

Answer: @WithMockUser

@WithMockUser populates the SecurityContext with a mock user, configurable with username, roles, and authorities, without requiring actual authentication.

What is the role of UserDetailsService in Spring Security?

Answer: Loads user-specific data from a data source during authentication

UserDetailsService is a core interface with a single loadUserByUsername() method that retrieves a UserDetails object from the application's data source.