Form-based login configuration in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user submits the login form with incorrect credentials?

Consider a Spring Boot application configured with form-based login. What is the typical behavior when a user submits the login form with wrong username or password?

A The user is redirected back to the login page with an error message indicating invalid credentials.

B The user is redirected to the home page without logging in.

C The application crashes and shows a server error page.

D The user is logged in but with limited permissions.

💡 Hint

Think about how Spring Security handles authentication failures by default.

Spring Security redirects users back to the login page and shows an error message when credentials are invalid.

📝 Syntax

intermediate

Which configuration snippet correctly enables form-based login in Spring Security?

Choose the correct Java configuration code to enable form-based login in a Spring Boot application using Spring Security.

A http.formLogin().authorizeHttpRequests().anyRequest().authenticated();

B http.authorizeRequests().permitAll().formLogin();

C http.authorizeHttpRequests().anyRequest().authenticated().and().formLogin();

D http.formLogin().permitAll().authorizeHttpRequests().anyRequest().authenticated();

💡 Hint

Remember the order: first define authorization, then enable form login.

The correct pattern is to first configure authorization rules, then call formLogin() to enable form-based login.

❓ state_output

advanced

What is the value of the 'principal' object after successful form login?

After a user successfully logs in via form-based login, what does the 'principal' object in the SecurityContext typically contain?

A Null because the user is anonymous.

B A plain string with the username only.

C An exception object indicating login success.

D An instance of UserDetails representing the authenticated user.

💡 Hint

Think about what Spring Security stores to represent the logged-in user.

Spring Security stores a UserDetails object as the principal after successful authentication.

🔧 Debug

advanced

Why does the custom login page not show after configuring formLogin().loginPage("/my-login")?

You configured form-based login with a custom login page URL '/my-login' but when accessing a protected page, the default login page still appears. What is the most likely cause?

A The controller for '/my-login' is missing or not mapped correctly.

B The loginPage() method must be called before authorizeHttpRequests().

C Spring Security does not support custom login pages.

D The application.properties file disables form login.

💡 Hint

Check if the URL you set for loginPage() actually serves a page.

If the custom login page URL is not handled by a controller or static resource, Spring Security falls back to the default login page.

🧠 Conceptual

expert

How does Spring Security handle CSRF protection with form-based login by default?

In a Spring Boot app with form-based login enabled, what is the default behavior of Spring Security regarding CSRF tokens?

A CSRF tokens are automatically added to all forms without developer action.

B CSRF protection is enabled by default and the login form must include the CSRF token to succeed.

C CSRF tokens are only required for GET requests.

D CSRF protection is disabled by default for form-based login.

💡 Hint

Think about security best practices for form submissions.

Spring Security enables CSRF protection by default. The login form must include the CSRF token to prevent attacks.