Form-based login configuration in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user submits the login form with incorrect credentials?

Consider a Spring Boot application configured with form-based login. What is the typical behavior when a user submits the login form with wrong username or password?

A The user is redirected back to the login page with an error message indicating invalid credentials.

B The user is redirected to the home page without logging in.

C The application crashes and shows a server error page.

D The user is logged in but with limited permissions.

💡 Hint

Think about how Spring Security handles authentication failures by default.

Spring Security redirects users back to the login page and shows an error message when credentials are invalid.

📝 Syntax

intermediate

Which configuration snippet correctly enables form-based login in Spring Security?

Choose the correct Java configuration code to enable form-based login in a Spring Boot application using Spring Security.

A http.formLogin().authorizeHttpRequests().anyRequest().authenticated();

B http.authorizeRequests().permitAll().formLogin();

C http.authorizeHttpRequests().anyRequest().authenticated().and().formLogin();

D http.formLogin().permitAll().authorizeHttpRequests().anyRequest().authenticated();

💡 Hint

Remember the order: first define authorization, then enable form login.

The correct pattern is to first configure authorization rules, then call formLogin() to enable form-based login.

❓ state_output

advanced

What is the value of the 'principal' object after successful form login?

After a user successfully logs in via form-based login, what does the 'principal' object in the SecurityContext typically contain?

A Null because the user is anonymous.

B A plain string with the username only.

C An exception object indicating login success.

D An instance of UserDetails representing the authenticated user.

💡 Hint

Think about what Spring Security stores to represent the logged-in user.

Spring Security stores a UserDetails object as the principal after successful authentication.

🔧 Debug

advanced

Why does the custom login page not show after configuring formLogin().loginPage("/my-login")?

You configured form-based login with a custom login page URL '/my-login' but when accessing a protected page, the default login page still appears. What is the most likely cause?

A The controller for '/my-login' is missing or not mapped correctly.

B The loginPage() method must be called before authorizeHttpRequests().

C Spring Security does not support custom login pages.

D The application.properties file disables form login.

💡 Hint

Check if the URL you set for loginPage() actually serves a page.

If the custom login page URL is not handled by a controller or static resource, Spring Security falls back to the default login page.

🧠 Conceptual

expert

How does Spring Security handle CSRF protection with form-based login by default?

In a Spring Boot app with form-based login enabled, what is the default behavior of Spring Security regarding CSRF tokens?

A CSRF tokens are automatically added to all forms without developer action.

B CSRF protection is enabled by default and the login form must include the CSRF token to succeed.

C CSRF tokens are only required for GET requests.

D CSRF protection is disabled by default for form-based login.

💡 Hint

Think about security best practices for form submissions.

Spring Security enables CSRF protection by default. The login form must include the CSRF token to prevent attacks.

Practice

1. What is the main purpose of formLogin() in Spring Security?

easy

A. To enable form-based login for user authentication

B. To disable all login methods

C. To configure database connections

D. To set up REST API endpoints

Solution

1. Step 1: Understand formLogin() role

   The formLogin() method in Spring Security enables users to log in using a web form.

2. Step 2: Compare with other options

   Other options like disabling login or configuring database are unrelated to formLogin().

3. Final Answer:

   To enable form-based login for user authentication -> Option A

4. Quick Check:

   formLogin() enables form login [OK]

Hint: Remember formLogin() means login via web form [OK]

Common Mistakes:

• Confusing formLogin() with database setup
• Thinking formLogin() disables login
• Mixing formLogin() with API configuration

2. Which of the following is the correct way to customize the login page URL in Spring Security?

easy

A. http.formLogin().loginPath("/custom-login")

B. http.formLogin().loginPage("/custom-login")

C. http.formLogin().pageUrl("/custom-login")

D. http.formLogin().setLoginUrl("/custom-login")

Solution

1. Step 1: Identify correct method for login page URL

   The method to set a custom login page URL is loginPage() used after formLogin().

2. Step 2: Verify syntax correctness

   Only http.formLogin().loginPage("/custom-login") uses the correct method name and syntax: loginPage("/custom-login").

3. Final Answer:

   http.formLogin().loginPage("/custom-login") -> Option B

4. Quick Check:

   loginPage() sets custom login URL [OK]

Hint: Use loginPage() to set custom login URL [OK]

Common Mistakes:

• Using incorrect method names like setLoginUrl()
• Confusing loginPage() with other methods
• Missing parentheses or quotes

3. Given the following Spring Security configuration snippet, what will be the behavior when a user accesses /login?

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .formLogin(form -> form.loginPage("/login").permitAll());

medium

A. Users are blocked from accessing /login without authentication

B. Users can access all pages without login

C. Users are redirected to the default login page instead of /login

D. Users see a custom login page at /login and can access it without authentication

Solution

1. Step 1: Analyze authorizeHttpRequests configuration

   All requests require authentication because of anyRequest().authenticated().

2. Step 2: Analyze formLogin configuration

   The login page is customized to /login and permitAll() allows everyone to access it without login.

3. Final Answer:

   Users see a custom login page at /login and can access it without authentication -> Option D

4. Quick Check:

   Custom login page with permitAll() means public access [OK]

Hint: permitAll() on loginPage() allows public access [OK]

Common Mistakes:

• Assuming /login requires authentication
• Thinking default login page is used
• Ignoring permitAll() effect

4. Identify the error in this Spring Security configuration snippet:

http
  .formLogin()
  .loginPage("/my-login")
  .permitAll();

medium

A. permitAll() should be called on authorizeHttpRequests, not formLogin

B. loginPage() must be called before formLogin()

C. permitAll() is not a valid method in Spring Security

D. The code is correct and will work as expected

Solution

1. Step 1: Check method chaining correctness

   In Spring Security, permitAll() is used on authorization rules, not directly on formLogin().

2. Step 2: Understand correct usage

   To allow public access to the login page, permitAll() should be called on the authorization configuration for the login page URL.

3. Final Answer:

   permitAll() should be called on authorizeHttpRequests, not formLogin -> Option A

4. Quick Check:

   permitAll() belongs to authorization, not formLogin [OK]

Hint: permitAll() controls access, use it in authorizeHttpRequests [OK]

Common Mistakes:

• Calling permitAll() on formLogin()
• Misplacing loginPage() call
• Assuming permitAll() is invalid

5. You want to create a Spring Security setup where: - The login page is at /user-login - The login page is accessible without authentication - All other pages require login Which configuration snippet correctly achieves this?

hard

A. http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login").permitAll());

B. http.formLogin().loginPage("/user-login").permitAll()
.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());

C. http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login"));

D. http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
.formLogin(form -> form.loginPage("/user-login"));

Solution

1. Step 1: Permit access to the login page

   Use requestMatchers("/user-login").permitAll() to allow unauthenticated access to the login page.

2. Step 2: Require authentication for all other requests

   Use anyRequest().authenticated() to protect all other endpoints.

3. Step 3: Configure form login with custom login page

   formLogin(form -> form.loginPage("/user-login")) sets the custom login page.

4. Final Answer:

   http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated()) .formLogin(form -> form.loginPage("/user-login")); -> Option C

5. Quick Check:

   Properly permits login page and protects others [OK]

Hint: Explicitly permit login page URL in authorizeHttpRequests [OK]

Common Mistakes:

• Not permitting the login page URL (option A)
• Invalid chaining after formLogin.permitAll() (option B)
• Permitting all requests (option D)