Method-level security in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is method-level security in Spring Boot?

Method-level security in Spring Boot means protecting individual methods in your code so only authorized users can run them. It controls access right where the action happens.

beginner

Which annotation is commonly used to secure methods by roles in Spring Boot?

The @PreAuthorize annotation is used to specify security rules before a method runs, like checking if a user has a certain role.

intermediate

How do you enable method-level security in a Spring Boot application?

You enable method-level security by adding @EnableMethodSecurity to a configuration class. This tells Spring to check security annotations on methods.

intermediate

What does @Secured annotation do in Spring Boot?

@Secured restricts method access to users with specific roles. It is simpler than @PreAuthorize but less flexible.

advanced

Why is method-level security useful compared to URL-based security?

Method-level security protects the actual business logic, so even if someone bypasses the web layer, they can't run protected methods. It adds a strong safety net.

Which annotation enables method-level security in Spring Boot?

A @EnableWebSecurity

B @EnableMethodSecurity

C @EnableGlobalMethodSecurity

D @EnableSecurity

Starting with Spring Security 6, @EnableMethodSecurity is used to enable method-level security.

What does @PreAuthorize("hasRole('ADMIN')") do?

A Allows only users with ADMIN role to run the method

B Prevents ADMIN users from running the method

C Runs the method before authorization

D Logs the ADMIN role before method execution

@PreAuthorize checks the user’s roles before allowing method execution.

Which annotation is simpler but less flexible than @PreAuthorize for method security?

A @Secured

B @RolesAllowed

C @PostAuthorize

D @PermitAll

@Secured only checks roles and is less flexible than @PreAuthorize which supports SpEL expressions.

Where do you place method-level security annotations?

A On entity classes

B Only on controller classes

C Only on configuration classes

D On service or controller methods

Method-level security annotations go on the methods you want to protect, often in service or controller classes.

Why use method-level security in addition to URL security?

A To avoid writing any URL security

B To speed up the application

C To protect business logic even if URL security is bypassed

D To allow all users access

Method-level security adds a second layer of protection directly on the code that does the work.

Explain how to secure a method in Spring Boot using annotations.

Think about what you add to your config and what you add to your methods.

Describe the benefits of method-level security compared to only URL-based security.

Consider what happens if someone tries to call methods without going through the web.