Authentication flow in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after successful login in Spring Security?

In a typical Spring Security authentication flow, what is the immediate next step after a user successfully logs in?

A The user is redirected to the originally requested protected resource or a default page.

B The application throws an AccessDeniedException.

C The user's password is reset automatically.

D The session is invalidated immediately.

💡 Hint

Think about what the user expects after logging in successfully.

After successful login, Spring Security redirects the user to the page they originally requested or a default page if none was requested.

❓ lifecycle

intermediate

Order of filters in Spring Security authentication flow

Which filter in Spring Security is responsible for processing username and password authentication before the request reaches the controller?

A ExceptionTranslationFilter

B BasicAuthenticationFilter

C SecurityContextPersistenceFilter

D UsernamePasswordAuthenticationFilter

💡 Hint

This filter handles form login credentials.

UsernamePasswordAuthenticationFilter processes login form data and attempts authentication before the request proceeds.

🔧 Debug

advanced

Why does authentication fail with this configuration?

Given this Spring Security configuration snippet, why does authentication always fail? @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .anyRequest().authenticated() .and() .formLogin() .loginPage("/login") .permitAll(); } } Options:

Spring Boot

Same as prompt

A The permitAll() call is misplaced and blocks all requests.

B The configure method lacks a password encoder bean, causing authentication failure.

C The custom login page "/login" is not implemented, so authentication fails.

D The anyRequest().authenticated() call allows anonymous access, so login is skipped.

💡 Hint

Check if the login page exists and is accessible.

If the custom login page URL is not implemented or accessible, Spring Security cannot show the login form, causing authentication to fail.

📝 Syntax

advanced

Identify the error in this Spring Security password encoder bean

What is wrong with this Spring Boot password encoder bean definition? @Bean public PasswordEncoder passwordEncoder() { return NoOpPasswordEncoder.getInstance(); } Options:

Spring Boot

Same as prompt

A NoOpPasswordEncoder is deprecated and insecure; it should not be used in production.

B The bean method is missing the @Component annotation.

C The method should return BCryptPasswordEncoder instead of NoOpPasswordEncoder.

D PasswordEncoder interface cannot be implemented as a bean.

💡 Hint

Consider security best practices for password encoding.

NoOpPasswordEncoder does not encode passwords and is insecure; it is deprecated and should only be used for testing.

🧠 Conceptual

expert

What is the role of SecurityContextHolder in Spring Security?

Choose the best description of SecurityContextHolder's role in Spring Security authentication flow.

A It manages database connections for user credentials.

B It stores security information like authentication details for the current thread of execution.

C It handles HTTP session creation and destruction.

D It encrypts passwords before saving them.

💡 Hint

Think about where Spring Security keeps user login info during a request.

SecurityContextHolder holds the Authentication object containing user details for the current thread, enabling access control decisions.