Form-based login configuration in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable form-based login in Spring Security.

Spring Boot

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .[1]();

Drag options to blanks, or click blank then click option'

AhttpBasic

BformLogin

Ccsrf

Dlogout

Attempts:

3 left

💡 Hint

Common Mistakes

Using httpBasic() instead of formLogin()

Forgetting to call any login method

The formLogin() method enables form-based login in Spring Security.

2fill in blank

medium

Complete the code to set a custom login page URL.

Spring Boot

http
  .formLogin(form -> form
    .loginPage("[1]")
  );

Drag options to blanks, or click blank then click option'

A/custom-login

B/logout

C/home

D/error

Attempts:

3 left

💡 Hint

Common Mistakes

Using the logout or error page URL instead of login page URL

Omitting the leading slash in the URL

The loginPage() method sets the URL for the custom login page.

3fill in blank

hard

Fix the error in configuring the login processing URL.

Spring Boot

http
  .formLogin(form -> form
    .loginProcessingUrl("[1]")
  );

Drag options to blanks, or click blank then click option'

A/process-login

Bprocess-login

C/login

Dlogin

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the leading slash in the URL

Using a URL that does not match the form action

The loginProcessingUrl() requires a URL starting with a slash to correctly map the login form submission.

4fill in blank

hard

Fill both blanks to configure a custom success and failure URL after login.

Spring Boot

http
  .formLogin(form -> form
    .defaultSuccessUrl("[1]")
    .failureUrl("[2]")
  );

Drag options to blanks, or click blank then click option'

A/dashboard

B/login-error

C/home

D/error

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up success and failure URLs

Using URLs that do not exist in the app

defaultSuccessUrl() sets where to go after successful login, and failureUrl() sets where to go after failure.

5fill in blank

hard

Fill all three blanks to configure form login with custom login page, success URL, and failure URL.

Spring Boot

http
  .formLogin(form -> form
    .loginPage("[1]")
    .defaultSuccessUrl("[2]")
    .failureUrl("[3]")
  );

Drag options to blanks, or click blank then click option'

A/user-login

B/welcome

C/login-failed

D/error

Attempts:

3 left

💡 Hint

Common Mistakes

Using URLs without leading slashes

Confusing success and failure URLs

This configures a custom login page at /user-login, redirects to /welcome on success, and to /login-failed on failure.

Practice

1. What is the main purpose of formLogin() in Spring Security?

easy

A. To enable form-based login for user authentication

B. To disable all login methods

C. To configure database connections

D. To set up REST API endpoints

Solution

1. Step 1: Understand formLogin() role

   The formLogin() method in Spring Security enables users to log in using a web form.

2. Step 2: Compare with other options

   Other options like disabling login or configuring database are unrelated to formLogin().

3. Final Answer:

   To enable form-based login for user authentication -> Option A

4. Quick Check:

   formLogin() enables form login [OK]

Hint: Remember formLogin() means login via web form [OK]

Common Mistakes:

• Confusing formLogin() with database setup
• Thinking formLogin() disables login
• Mixing formLogin() with API configuration

2. Which of the following is the correct way to customize the login page URL in Spring Security?

easy

A. http.formLogin().loginPath("/custom-login")

B. http.formLogin().loginPage("/custom-login")

C. http.formLogin().pageUrl("/custom-login")

D. http.formLogin().setLoginUrl("/custom-login")

Solution

1. Step 1: Identify correct method for login page URL

   The method to set a custom login page URL is loginPage() used after formLogin().

2. Step 2: Verify syntax correctness

   Only http.formLogin().loginPage("/custom-login") uses the correct method name and syntax: loginPage("/custom-login").

3. Final Answer:

   http.formLogin().loginPage("/custom-login") -> Option B

4. Quick Check:

   loginPage() sets custom login URL [OK]

Hint: Use loginPage() to set custom login URL [OK]

Common Mistakes:

• Using incorrect method names like setLoginUrl()
• Confusing loginPage() with other methods
• Missing parentheses or quotes

3. Given the following Spring Security configuration snippet, what will be the behavior when a user accesses /login?

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .formLogin(form -> form.loginPage("/login").permitAll());

medium

A. Users are blocked from accessing /login without authentication

B. Users can access all pages without login

C. Users are redirected to the default login page instead of /login

D. Users see a custom login page at /login and can access it without authentication

Solution

1. Step 1: Analyze authorizeHttpRequests configuration

   All requests require authentication because of anyRequest().authenticated().

2. Step 2: Analyze formLogin configuration

   The login page is customized to /login and permitAll() allows everyone to access it without login.

3. Final Answer:

   Users see a custom login page at /login and can access it without authentication -> Option D

4. Quick Check:

   Custom login page with permitAll() means public access [OK]

Hint: permitAll() on loginPage() allows public access [OK]

Common Mistakes:

• Assuming /login requires authentication
• Thinking default login page is used
• Ignoring permitAll() effect

4. Identify the error in this Spring Security configuration snippet:

http
  .formLogin()
  .loginPage("/my-login")
  .permitAll();

medium

A. permitAll() should be called on authorizeHttpRequests, not formLogin

B. loginPage() must be called before formLogin()

C. permitAll() is not a valid method in Spring Security

D. The code is correct and will work as expected

Solution

1. Step 1: Check method chaining correctness

   In Spring Security, permitAll() is used on authorization rules, not directly on formLogin().

2. Step 2: Understand correct usage

   To allow public access to the login page, permitAll() should be called on the authorization configuration for the login page URL.

3. Final Answer:

   permitAll() should be called on authorizeHttpRequests, not formLogin -> Option A

4. Quick Check:

   permitAll() belongs to authorization, not formLogin [OK]

Hint: permitAll() controls access, use it in authorizeHttpRequests [OK]

Common Mistakes:

• Calling permitAll() on formLogin()
• Misplacing loginPage() call
• Assuming permitAll() is invalid

5. You want to create a Spring Security setup where: - The login page is at /user-login - The login page is accessible without authentication - All other pages require login Which configuration snippet correctly achieves this?

hard

A. http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login").permitAll());

B. http.formLogin().loginPage("/user-login").permitAll()
.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());

C. http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login"));

D. http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
.formLogin(form -> form.loginPage("/user-login"));

Solution

1. Step 1: Permit access to the login page

   Use requestMatchers("/user-login").permitAll() to allow unauthenticated access to the login page.

2. Step 2: Require authentication for all other requests

   Use anyRequest().authenticated() to protect all other endpoints.

3. Step 3: Configure form login with custom login page

   formLogin(form -> form.loginPage("/user-login")) sets the custom login page.

4. Final Answer:

   http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated()) .formLogin(form -> form.loginPage("/user-login")); -> Option C

5. Quick Check:

   Properly permits login page and protects others [OK]

Hint: Explicitly permit login page URL in authorizeHttpRequests [OK]

Common Mistakes:

• Not permitting the login page URL (option A)
• Invalid chaining after formLogin.permitAll() (option B)
• Permitting all requests (option D)