Method-level security in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without the required role calls a secured method?

Consider a Spring Boot service method annotated with @PreAuthorize("hasRole('ADMIN')"). What is the behavior when a user without the ADMIN role tries to invoke this method?

Spring Boot

public class UserService {
    @PreAuthorize("hasRole('ADMIN')")
    public String getAdminData() {
        return "Sensitive admin data";
    }
}

A A runtime AccessDeniedException is thrown before the method executes.

B The application crashes with a NullPointerException.

C The method returns null without throwing an error.

D The method executes normally and returns the data.

💡 Hint

Think about what Spring Security does when access is denied at method level.

Spring Security checks the user's roles before method execution. If the user lacks the required role, it throws an AccessDeniedException and prevents the method from running.

📝 Syntax

intermediate

Which annotation correctly restricts method access to users with 'USER' role?

Choose the correct Spring Security annotation to restrict access to a method so only users with the USER role can call it.

A @RolesAllowed("ROLE_USER")

B @Secured("USER")

C @PreAuthorize("hasRole('USER')")

D @PreAuthorize("hasAuthority('USER')")

💡 Hint

Remember the exact syntax for @PreAuthorize and role prefixes.

The @PreAuthorize annotation requires the role name with hasRole('ROLE_NAME'). The role prefix ROLE_ is added automatically, so just use hasRole('USER').

❓ state_output

advanced

What is the output when a method with @PostAuthorize returns a filtered list?

Given the following method secured with @PostAuthorize, what will be the output if the user has the ADMIN role?

Spring Boot

public class ProductService {
    @PostAuthorize("returnObject.owner == authentication.name or hasRole('ADMIN')")
    public Product getProduct(int id) {
        return new Product(id, "Book", "user1");
    }
}

// User 'admin' calls getProduct(1)

A Returns the Product object with id 1 and owner 'user1'.

B Returns null because the user is not the owner.

C Throws AccessDeniedException because the user is not the owner.

D Returns a list of all products.

💡 Hint

Think about what @PostAuthorize does after method execution.

@PostAuthorize checks the returned object after the method runs. Since the user has the ADMIN role, the condition passes and the product is returned.

🔧 Debug

advanced

Why does this @PreAuthorize expression cause a syntax error?

Identify the syntax error in this Spring Security method annotation:

@PreAuthorize("hasRole('ADMIN') && hasPermission(#id, 'read')")

A The quotes around 'read' should be double quotes, not single quotes.

B The expression uses '&&' which is invalid; it should use 'and'.

C The method parameter '#id' is not accessible in the expression.

D The annotation must be @PostAuthorize, not @PreAuthorize.

💡 Hint

Check the logical operators allowed in Spring Security SpEL expressions.

Spring Security SpEL uses and instead of && for logical AND. Using && causes a syntax error.

🧠 Conceptual

expert

Which statement best describes method-level security with Spring AOP proxies?

In Spring Security, method-level security is often implemented using proxies. Which statement below is true about how this affects method calls within the same class?

A Method-level security requires explicit calls to security methods inside the class.

B All method calls, internal or external, go through the proxy and are secured.

C Security checks are applied only if methods are called from outside the application.

D Internal method calls within the same class bypass security checks because proxies are not involved.

💡 Hint

Think about how Spring AOP proxies work with self-invocation.

Spring AOP proxies intercept calls made from outside the bean. Internal calls within the same class do not go through the proxy, so security annotations are not applied in those cases.