Spring Security & Testing Flashcards

What is the default login URL provided by Spring Security's form login feature?

Answer: /login

Spring Security auto-generates a /login page when form login is enabled and no custom login page is configured.

Which annotation enables Spring Security's method-level security?

Answer: @EnableMethodSecurity

@EnableMethodSecurity (Spring Security 5.6+) activates method-level annotations like @PreAuthorize, @PostAuthorize, and @Secured.

What does the @PreAuthorize annotation do in Spring Security?

Answer: Evaluates a SpEL expression before a method is invoked to check authorization

@PreAuthorize evaluates a Spring Expression Language (SpEL) authorization expression before the target method executes, denying access if it returns false.

In Spring Security, what is a GrantedAuthority?

Answer: A permission or role assigned to a user

GrantedAuthority represents a permission or role (e.g., ROLE_ADMIN) granted to a principal, used in access control decisions.

What Spring Security class is used to encode passwords before storing them?

Answer: PasswordEncoder

PasswordEncoder is the interface Spring Security uses for one-way password encoding; BCryptPasswordEncoder is the recommended implementation.

What HTTP status does Spring Security return by default when an unauthenticated user accesses a protected resource?

Answer: 302 Redirect to login

By default, Spring Security redirects unauthenticated users to the login page (HTTP 302) rather than returning a 401 directly.