Spring Security Interview Questions

Spring Security uses filters to inspect requests, authenticate users, create a security context, and authorize access. Spring Boot provides the dependencies and a convenient configuration entry point.

Authentication answers “Who are you?” Authorization answers “What are you allowed to do?” A secure application performs both checks before protected work.

The filter chain is an ordered set of servlet filters that handles security concerns such as credentials, sessions, CSRF, and authorization. SecurityFilterChain is the bean used to configure those rules.

The filter chain is an ordered set of servlet filters that handles security concerns such as credentials, sessions, CSRF, and authorization. SecurityFilterChain is the bean used to configure those rules.

Configure request rules in SecurityFilterChain using requestMatchers and authenticated, hasRole, or hasAuthority. Put specific rules before broad fallback rules.

An authority is a permission string. A role is a conventionally named authority, often prefixed with ROLE_. Use roles for broad groups and authorities for fine-grained permissions.

A JWT contains a header, claims payload, and signature. The server verifies the signature and important claims such as issuer and expiry, then uses the subject or authorities for authorization. Short-lived access tokens and a controlled refresh-token flow reduce risk.

A JWT contains a header, claims payload, and signature. The server verifies the signature and important claims such as issuer and expiry, then uses the subject or authorities for authorization. Short-lived access tokens and a controlled refresh-token flow reduce risk.

A JWT contains a header, claims payload, and signature. The server verifies the signature and important claims such as issuer and expiry, then uses the subject or authorities for authorization. Short-lived access tokens and a controlled refresh-token flow reduce risk.

OAuth 2.0 is an authorization framework that lets a client obtain limited access to a resource on behalf of a user or service. It defines flows and tokens; it is not itself a user-identity protocol.

OpenID Connect adds an identity layer on top of OAuth 2.0. It provides an ID token and standard user claims so a client can verify who authenticated.

CSRF protects browser-based applications from forged state-changing requests. CORS controls which browser origins may call an API. They solve different problems and should not be treated as substitutes.

CSRF protects browser-based applications from forged state-changing requests. CORS controls which browser origins may call an API. They solve different problems and should not be treated as substitutes.

CSRF protects browser-based applications from forged state-changing requests. CORS controls which browser origins may call an API. They solve different problems and should not be treated as substitutes.

Enable method security and place authorization annotations on service methods. @PreAuthorize checks an expression before execution, while @PostAuthorize checks it after the method returns.

Enable method security and place authorization annotations on service methods. @PreAuthorize checks an expression before execution, while @PostAuthorize checks it after the method returns.

Store a one-way adaptive hash, never plaintext or reversible encryption. PasswordEncoder implementations such as BCrypt or a delegating encoder salt and hash passwords and can support algorithm upgrades.

Store a one-way adaptive hash, never plaintext or reversible encryption. PasswordEncoder implementations such as BCrypt or a delegating encoder salt and hash passwords and can support algorithm upgrades.

Actuator exposes operational endpoints such as health, info, metrics, loggers, and mappings. Expose only the endpoints needed by operators and protect them with authentication and network controls.

Spring Security 6 uses the Jakarta namespace and requires modern Java and Spring versions. WebSecurityConfigurerAdapter is removed, so applications configure one or more SecurityFilterChain beans and use the updated authorization APIs.