Authentication flow in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after successful login in Spring Security?

In a typical Spring Security authentication flow, what is the immediate next step after a user successfully logs in?

A The user is redirected to the originally requested protected resource or a default page.

B The application throws an AccessDeniedException.

C The user's password is reset automatically.

D The session is invalidated immediately.

💡 Hint

Think about what the user expects after logging in successfully.

After successful login, Spring Security redirects the user to the page they originally requested or a default page if none was requested.

❓ lifecycle

intermediate

Order of filters in Spring Security authentication flow

Which filter in Spring Security is responsible for processing username and password authentication before the request reaches the controller?

A ExceptionTranslationFilter

B BasicAuthenticationFilter

C SecurityContextPersistenceFilter

D UsernamePasswordAuthenticationFilter

💡 Hint

This filter handles form login credentials.

UsernamePasswordAuthenticationFilter processes login form data and attempts authentication before the request proceeds.

🔧 Debug

advanced

Why does authentication fail with this configuration?

Given this Spring Security configuration snippet, why does authentication always fail? @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .anyRequest().authenticated() .and() .formLogin() .loginPage("/login") .permitAll(); } } Options:

Spring Boot

Same as prompt

A The permitAll() call is misplaced and blocks all requests.

B The configure method lacks a password encoder bean, causing authentication failure.

C The custom login page "/login" is not implemented, so authentication fails.

D The anyRequest().authenticated() call allows anonymous access, so login is skipped.

💡 Hint

Check if the login page exists and is accessible.

If the custom login page URL is not implemented or accessible, Spring Security cannot show the login form, causing authentication to fail.

📝 Syntax

advanced

Identify the error in this Spring Security password encoder bean

What is wrong with this Spring Boot password encoder bean definition? @Bean public PasswordEncoder passwordEncoder() { return NoOpPasswordEncoder.getInstance(); } Options:

Spring Boot

Same as prompt

A NoOpPasswordEncoder is deprecated and insecure; it should not be used in production.

B The bean method is missing the @Component annotation.

C The method should return BCryptPasswordEncoder instead of NoOpPasswordEncoder.

D PasswordEncoder interface cannot be implemented as a bean.

💡 Hint

Consider security best practices for password encoding.

NoOpPasswordEncoder does not encode passwords and is insecure; it is deprecated and should only be used for testing.

🧠 Conceptual

expert

What is the role of SecurityContextHolder in Spring Security?

Choose the best description of SecurityContextHolder's role in Spring Security authentication flow.

A It manages database connections for user credentials.

B It stores security information like authentication details for the current thread of execution.

C It handles HTTP session creation and destruction.

D It encrypts passwords before saving them.

💡 Hint

Think about where Spring Security keeps user login info during a request.

SecurityContextHolder holds the Authentication object containing user details for the current thread, enabling access control decisions.

Practice

1. What is the main purpose of the authentication flow in a Spring Boot application?

easy

A. To send emails to users after login

B. To style the user interface of the login page

C. To store user data in the database

D. To verify the identity of a user before granting access

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flow is about checking who the user is before allowing access.

2. Step 2: Identify correct purpose in options

   Only To verify the identity of a user before granting access describes verifying user identity, which matches authentication.

3. Final Answer:

   To verify the identity of a user before granting access -> Option D

4. Quick Check:

   Authentication = Verify user identity [OK]

Hint: Authentication means checking who the user is [OK]

Common Mistakes:

• Confusing authentication with styling or data storage
• Thinking authentication sends emails
• Mixing authentication with authorization

2. Which of the following is the correct way to configure URL access rules in Spring Security?

easy

A. http.authorizeHttpRequests().requestMatchers("/admin/**").authenticated()

B. http.authorizeRequests().antMatchers("/private/**").denyAll()

C. http.authorizeRequests().anyRequest().allow()

D. http.authorizeRequests().requestMatchers("/public/**").permitAll()

Solution

1. Step 1: Identify correct method for URL rules in Spring Security

   Spring Security 6+ uses http.authorizeHttpRequests() with requestMatchers() for URL patterns.

2. Step 2: Check which option uses correct syntax and meaning

   http.authorizeHttpRequests().requestMatchers("/admin/**").authenticated() uses authorizeHttpRequests() and requestMatchers() with authenticated(), which is correct.

3. Final Answer:

   http.authorizeHttpRequests().requestMatchers("/admin/**").authenticated() -> Option A

4. Quick Check:

   Use authorizeHttpRequests() + requestMatchers() [OK]

Hint: Use authorizeHttpRequests() with requestMatchers() in Spring Security 6+ [OK]

Common Mistakes:

• Using deprecated authorizeRequests() in new Spring versions
• Using denyAll() incorrectly for access control
• Using anyRequest().allow() which is invalid

3. Given this Spring Security configuration snippet, what happens when a user accesses /dashboard without logging in?

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/public/**").permitAll()
    .anyRequest().authenticated()
  )
  .formLogin();

medium

A. The user can access /dashboard without login

B. The user is redirected to the login page

C. The user gets a 403 Forbidden error

D. The user sees a blank page

Solution

1. Step 1: Analyze URL access rules

   /public/** URLs are open, but any other request requires authentication.

2. Step 2: Check behavior for unauthenticated access to /dashboard

   Since /dashboard is not under /public, it requires login. formLogin() triggers redirect to login page.

3. Final Answer:

   The user is redirected to the login page -> Option B

4. Quick Check:

   Unauthenticated access redirects to login [OK]

Hint: AnyRequest().authenticated() means login required [OK]

Common Mistakes:

• Thinking permitAll() applies to all URLs
• Expecting 403 error instead of redirect
• Assuming access without login

4. Identify the error in this Spring Security configuration snippet:

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin/**").permitAll()
    .anyRequest().authenticated()
  )
  .formLogin();

medium

A. formLogin() is missing a login page URL

B. anyRequest().authenticated() should come before requestMatchers()

C. permitAll() on /admin/** allows unrestricted access to admin pages

D. requestMatchers() should be replaced with antMatchers()

Solution

1. Step 1: Review access rules for /admin/**

   permitAll() means anyone can access /admin/** without login, which is usually a security risk.

2. Step 2: Check order and methods

   Order is correct; anyRequest().authenticated() applies after permitAll(). formLogin() without URL uses default login page, which is valid.

3. Final Answer:

   permitAll() on /admin/** allows unrestricted access to admin pages -> Option C

4. Quick Check:

   permitAll() means open access [OK]

Hint: permitAll() means no login needed, risky on admin URLs [OK]

Common Mistakes:

• Thinking order of matchers is wrong here
• Assuming formLogin() needs explicit URL
• Confusing requestMatchers() with antMatchers()

5. You want to create a custom authentication flow that checks a user's email and password against a database and then grants access. Which Spring Boot component should you implement to handle this logic?

hard

A. UserDetailsService to load user data and PasswordEncoder to check password

B. AuthenticationEntryPoint to redirect users after login

C. CorsConfiguration to allow cross-origin requests

D. HttpFirewall to block unauthorized IP addresses

Solution

1. Step 1: Identify component for loading user info

   UserDetailsService is designed to load user details like email and password from a database.

2. Step 2: Identify component for password checking

   PasswordEncoder is used to verify the password matches the stored hash securely.

3. Step 3: Confirm other options are unrelated

   AuthenticationEntryPoint handles unauthorized access, not authentication logic. CorsConfiguration and HttpFirewall serve different purposes.

4. Final Answer:

   UserDetailsService to load user data and PasswordEncoder to check password -> Option A

5. Quick Check:

   Custom auth uses UserDetailsService + PasswordEncoder [OK]

Hint: UserDetailsService loads users; PasswordEncoder checks passwords [OK]

Common Mistakes:

• Confusing AuthenticationEntryPoint with authentication logic
• Using CorsConfiguration for authentication
• Thinking HttpFirewall handles login checks