Authentication flow in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a Spring Boot controller method that handles login requests.

Spring Boot

public ResponseEntity<String> login(@RequestBody LoginRequest [1]) {
    // method body
}

Drag options to blanks, or click blank then click option'

ArequestBody

BloginRequest

Cuser

Dcredentials

Attempts:

3 left

💡 Hint

Common Mistakes

Using generic names like 'user' or 'credentials' that are less clear.

Using names that conflict with Spring annotations.

The parameter name loginRequest clearly represents the login data object received in the request body.

2fill in blank

medium

Complete the code to inject the authentication manager bean into the service class.

Spring Boot

@Autowired
private [1] authenticationManager;

Drag options to blanks, or click blank then click option'

AAuthenticationService

BSecurityManager

CAuthManager

DAuthenticationManager

Attempts:

3 left

💡 Hint

Common Mistakes

Using custom or incorrect class names.

Confusing with service or manager classes not related to authentication.

The correct Spring Security interface to handle authentication is AuthenticationManager.

3fill in blank

hard

Fix the error in the code that authenticates a user with username and password.

Spring Boot

Authentication authentication = authenticationManager.authenticate(
    new UsernamePasswordAuthenticationToken([1], password)
);

Drag options to blanks, or click blank then click option'

Apassword

Bauthentication

Cusername

DuserDetails

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping username and password parameters.

Passing the whole authentication object instead of username.

The first argument to UsernamePasswordAuthenticationToken must be the username, not the password.

4fill in blank

hard

Fill both blanks to create a JWT token after successful authentication.

Spring Boot

String token = jwtUtil.[1](authentication.getName(), [2]);

Drag options to blanks, or click blank then click option'

AgenerateToken

BvalidateToken

Cauthentication.getAuthorities()

Dauthentication.getCredentials()

Attempts:

3 left

💡 Hint

Common Mistakes

Using token validation method instead of generation.

Passing credentials instead of authorities.

Use generateToken to create the token and pass the username and authorities for claims.

5fill in blank

hard

Fill all three blanks to configure HTTP security to require authentication for all requests except login.

Spring Boot

http.csrf().disable()
    .authorizeHttpRequests()
    .requestMatchers("/login").[1]()
    .anyRequest().[2]()
    .and()
    .sessionManagement().sessionCreationPolicy([3]);

Drag options to blanks, or click blank then click option'

ApermitAll

Bauthenticated

CSessionCreationPolicy.STATELESS

DSessionCreationPolicy.ALWAYS

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting to disable CSRF for stateless APIs.

Using wrong session creation policy causing stateful sessions.

Not permitting access to login endpoint.

Allow all users to access /login without authentication, require authentication for other requests, and use stateless sessions for JWT.