Custom permission evaluator in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when a user without the required permission tries to access a secured method?

Consider a Spring Boot application using a custom permission evaluator. The evaluator denies access if the user lacks the required permission. What happens when a user without permission calls a method secured with @PreAuthorize("hasPermission(#id, 'read')")?

Spring Boot

public class CustomPermissionEvaluator implements PermissionEvaluator {
    @Override
    public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) {
        // returns true only if user has permission
        return auth.getAuthorities().stream()
            .anyMatch(grantedAuthority -> grantedAuthority.getAuthority().equals(permission.toString()));
    }

    @Override
    public boolean hasPermission(Authentication auth, Serializable targetId, String targetType, Object permission) {
        return false;
    }
}

// Usage in service
@PreAuthorize("hasPermission(#id, 'read')")
public String getData(Long id) {
    return "data";
}

A Spring Security throws an AccessDeniedException preventing method execution.

B The method executes normally and returns "data".

C The method returns null without exception.

D A runtime NullPointerException occurs due to missing permission.

💡 Hint

Think about what Spring Security does when permission checks fail.

When the custom permission evaluator returns false, Spring Security blocks access by throwing AccessDeniedException, so the method is not executed.

📝 Syntax

intermediate

Which option correctly implements the hasPermission method signature for checking permission by target ID and type?

You want to implement the hasPermission method in a custom permission evaluator that checks permission based on target ID and target type. Which method signature is correct?

A public boolean hasPermission(Authentication auth, String targetType, Serializable targetId, Object permission)

B public boolean hasPermission(Authentication auth, Long targetId, String permission)

C public boolean hasPermission(Authentication auth, Serializable targetId, String targetType, Object permission)

D public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission)

💡 Hint

Check the PermissionEvaluator interface method signatures.

The PermissionEvaluator interface defines two hasPermission methods. The one with targetId and targetType has the signature: hasPermission(Authentication, Serializable, String, Object).

🔧 Debug

advanced

Why does the custom permission evaluator always deny access even when the user has the correct authority?

Given this custom permission evaluator code, why does it always deny access? public class CustomPermissionEvaluator implements PermissionEvaluator { @Override public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) { return auth.getAuthorities().stream() .anyMatch(grantedAuthority -> grantedAuthority.getAuthority().equals(permission.toString())); } @Override public boolean hasPermission(Authentication auth, Serializable targetId, String targetType, Object permission) { return false; } } User has authority "read" but access is denied.

A The authorities list is empty because authentication is null.

B The permission object passed is not a String, so equals comparison fails.

C The hasPermission method with targetId and targetType always returns false, causing denial.

D The permission evaluator is not registered as a bean, so it is not used.

💡 Hint

Check the type and value of the permission parameter in the equals check.

If permission is not a String, calling equals(permission.toString()) may fail if permission.toString() does not match authority strings exactly, causing the check to always fail.

🧠 Conceptual

advanced

What is the role of the custom permission evaluator in Spring Security?

In Spring Security, what is the main purpose of implementing a custom permission evaluator?

A To handle session management and timeout policies.

B To replace the AuthenticationManager for user login authentication.

C To configure HTTP security rules like URL patterns and roles.

D To provide fine-grained access control by evaluating permissions dynamically at method or domain object level.

💡 Hint

Think about what permission evaluation means beyond simple role checks.

Custom permission evaluators allow checking permissions dynamically on domain objects or method parameters, enabling fine-grained security beyond static roles.

❓ state_output

expert

What is the value of 'result' after evaluating this Spring EL expression with a custom permission evaluator?

Assume a method annotated with @PreAuthorize("hasPermission(#doc, 'write')") is called with a document object doc. The custom permission evaluator returns true only if the user has 'write' authority. Given the user has authorities ['read', 'write'], what is the value of the boolean variable result after evaluating the expression hasPermission(doc, 'write')?

Spring Boot

Authentication auth = // user with authorities ['read', 'write']
Document doc = new Document();
boolean result = customPermissionEvaluator.hasPermission(auth, doc, "write");

A true

B false

C null

D Throws AccessDeniedException

💡 Hint

Check if the user authorities contain the required permission string.

Since the user has 'write' authority and the evaluator checks for that, the method returns true, so result is true.