Form-based login configuration in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is form-based login in Spring Boot?

Form-based login is a way to authenticate users by showing a login form where they enter their username and password. Spring Security handles the form submission and checks credentials.

intermediate

Which Spring Security class is commonly extended or configured to set up form-based login?

You usually configure form-based login by customizing the SecurityFilterChain bean or extending WebSecurityConfigurerAdapter (older versions). In Spring Boot 3+, use SecurityFilterChain with HttpSecurity.

beginner

What method in HttpSecurity enables form-based login configuration?

The method is formLogin(). It allows you to customize the login page, success handler, failure handler, and more.

intermediate

How do you specify a custom login page URL in form-based login?

Use formLogin().loginPage("/custom-login") in your HttpSecurity configuration to tell Spring Security to use your own login page.

beginner

What happens if you do not configure a custom login page in Spring Boot form-based login?

Spring Security provides a default login page automatically. It is a simple form that asks for username and password.

Which method starts form-based login configuration in Spring Security?

A authorizeRequests()

B formLogin()

C csrf()

D httpBasic()

The formLogin() method enables form-based login configuration.

How do you set a custom login page URL in Spring Boot form login?

A formLogin().loginPage("/my-login")

B httpBasic().loginPage("/my-login")

C formLogin().defaultSuccessUrl("/my-login")

D csrf().loginPage("/my-login")

Use formLogin().loginPage("/my-login") to specify a custom login page.

What does Spring Boot provide if no custom login page is configured?

A Redirect to home page

B No login page, access denied

C A default login form page

D An error page

Spring Security automatically provides a default login form page.

In Spring Boot 3+, which bean is recommended to configure security including form login?

A SecurityFilterChain

B WebSecurityConfigurerAdapter

C AuthenticationManager

D UserDetailsService

SecurityFilterChain bean with HttpSecurity is the modern way to configure security.

Which of these is NOT a feature you can customize in formLogin()?

A loginPage URL

B successHandler

C failureHandler

D database connection

Database connection is unrelated to formLogin() customization.

Explain how to configure a custom form-based login page in Spring Boot.

Think about how you tell Spring Security to use your own login page URL.

Describe what happens when a user accesses a secured page without being logged in using form-based login.

Consider the user flow from accessing a protected resource to successful login.

Practice

1. What is the main purpose of formLogin() in Spring Security?

easy

A. To enable form-based login for user authentication

B. To disable all login methods

C. To configure database connections

D. To set up REST API endpoints

Solution

1. Step 1: Understand formLogin() role

   The formLogin() method in Spring Security enables users to log in using a web form.

2. Step 2: Compare with other options

   Other options like disabling login or configuring database are unrelated to formLogin().

3. Final Answer:

   To enable form-based login for user authentication -> Option A

4. Quick Check:

   formLogin() enables form login [OK]

Hint: Remember formLogin() means login via web form [OK]

Common Mistakes:

• Confusing formLogin() with database setup
• Thinking formLogin() disables login
• Mixing formLogin() with API configuration

2. Which of the following is the correct way to customize the login page URL in Spring Security?

easy

A. http.formLogin().loginPath("/custom-login")

B. http.formLogin().loginPage("/custom-login")

C. http.formLogin().pageUrl("/custom-login")

D. http.formLogin().setLoginUrl("/custom-login")

Solution

1. Step 1: Identify correct method for login page URL

   The method to set a custom login page URL is loginPage() used after formLogin().

2. Step 2: Verify syntax correctness

   Only http.formLogin().loginPage("/custom-login") uses the correct method name and syntax: loginPage("/custom-login").

3. Final Answer:

   http.formLogin().loginPage("/custom-login") -> Option B

4. Quick Check:

   loginPage() sets custom login URL [OK]

Hint: Use loginPage() to set custom login URL [OK]

Common Mistakes:

• Using incorrect method names like setLoginUrl()
• Confusing loginPage() with other methods
• Missing parentheses or quotes

3. Given the following Spring Security configuration snippet, what will be the behavior when a user accesses /login?

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .formLogin(form -> form.loginPage("/login").permitAll());

medium

A. Users are blocked from accessing /login without authentication

B. Users can access all pages without login

C. Users are redirected to the default login page instead of /login

D. Users see a custom login page at /login and can access it without authentication

Solution

1. Step 1: Analyze authorizeHttpRequests configuration

   All requests require authentication because of anyRequest().authenticated().

2. Step 2: Analyze formLogin configuration

   The login page is customized to /login and permitAll() allows everyone to access it without login.

3. Final Answer:

   Users see a custom login page at /login and can access it without authentication -> Option D

4. Quick Check:

   Custom login page with permitAll() means public access [OK]

Hint: permitAll() on loginPage() allows public access [OK]

Common Mistakes:

• Assuming /login requires authentication
• Thinking default login page is used
• Ignoring permitAll() effect

4. Identify the error in this Spring Security configuration snippet:

http
  .formLogin()
  .loginPage("/my-login")
  .permitAll();

medium

A. permitAll() should be called on authorizeHttpRequests, not formLogin

B. loginPage() must be called before formLogin()

C. permitAll() is not a valid method in Spring Security

D. The code is correct and will work as expected

Solution

1. Step 1: Check method chaining correctness

   In Spring Security, permitAll() is used on authorization rules, not directly on formLogin().

2. Step 2: Understand correct usage

   To allow public access to the login page, permitAll() should be called on the authorization configuration for the login page URL.

3. Final Answer:

   permitAll() should be called on authorizeHttpRequests, not formLogin -> Option A

4. Quick Check:

   permitAll() belongs to authorization, not formLogin [OK]

Hint: permitAll() controls access, use it in authorizeHttpRequests [OK]

Common Mistakes:

• Calling permitAll() on formLogin()
• Misplacing loginPage() call
• Assuming permitAll() is invalid

5. You want to create a Spring Security setup where: - The login page is at /user-login - The login page is accessible without authentication - All other pages require login Which configuration snippet correctly achieves this?

hard

A. http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login").permitAll());

B. http.formLogin().loginPage("/user-login").permitAll()
.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());

C. http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login"));

D. http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
.formLogin(form -> form.loginPage("/user-login"));

Solution

1. Step 1: Permit access to the login page

   Use requestMatchers("/user-login").permitAll() to allow unauthenticated access to the login page.

2. Step 2: Require authentication for all other requests

   Use anyRequest().authenticated() to protect all other endpoints.

3. Step 3: Configure form login with custom login page

   formLogin(form -> form.loginPage("/user-login")) sets the custom login page.

4. Final Answer:

   http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated()) .formLogin(form -> form.loginPage("/user-login")); -> Option C

5. Quick Check:

   Properly permits login page and protects others [OK]

Hint: Explicitly permit login page URL in authorizeHttpRequests [OK]

Common Mistakes:

• Not permitting the login page URL (option A)
• Invalid chaining after formLogin.permitAll() (option B)
• Permitting all requests (option D)