Method-level security in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable method-level security in a Spring Boot application.

Spring Boot

@Configuration
@Enable[1]
public class SecurityConfig {
}

Drag options to blanks, or click blank then click option'

AWebSecurity

BEnableSecurity

CMethodSecurity

DGlobalMethodSecurity

Attempts:

3 left

💡 Hint

Common Mistakes

Using @EnableWebSecurity instead of @EnableGlobalMethodSecurity

Misspelling the annotation name

Not adding any annotation

The annotation @EnableGlobalMethodSecurity activates method-level security annotations like @PreAuthorize.

2fill in blank

medium

Complete the code to restrict access to the method to users with the role 'ADMIN'.

Spring Boot

@PreAuthorize("hasRole('[1]')")
public void deleteUser(Long id) {
    // method body
}

Drag options to blanks, or click blank then click option'

AUSER

BADMIN

CGUEST

DMANAGER

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ROLE_ADMIN' instead of 'ADMIN' inside hasRole

Using a role that does not exist

Forgetting to add @PreAuthorize

The @PreAuthorize annotation checks if the user has the specified role before allowing method execution.

3fill in blank

hard

Fix the error in the method-level security annotation to allow access only if the user has 'USER' role and the id matches the authenticated user's id.

Spring Boot

@PreAuthorize("hasRole('[1]') and #id == authentication.principal.id")
public void updateProfile(Long id) {
    // method body
}

Drag options to blanks, or click blank then click option'

AADMIN

BGUEST

CUSER

DMANAGER

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ADMIN' role which is too restrictive

Using 'GUEST' role which is too permissive

Incorrect SpEL expression syntax

The method should allow only users with the 'USER' role to update their own profile, so 'USER' is the correct role.

4fill in blank

hard

Fill both blanks to create a method that allows access only if the user has 'ADMIN' role or the user id matches the authenticated user's id.

Spring Boot

@PreAuthorize("hasRole('[1]') or #id [2] authentication.principal.id")
public void accessResource(Long id) {
    // method body
}

Drag options to blanks, or click blank then click option'

AADMIN

B==

C!=

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'USER' role instead of 'ADMIN'

Using '!=' operator which denies access when ids match

Forgetting to use # before id in SpEL

The method allows access if the user has 'ADMIN' role or if the id matches the authenticated user's id, so the operator should be '=='.

5fill in blank

hard

Fill all three blanks to create a method that allows access only if the user has 'MANAGER' role and the department matches the authenticated user's department.

Spring Boot

@PreAuthorize("hasRole('[1]') and #dept [2] authentication.principal.[3]")
public void manageDepartment(String dept) {
    // method body
}

Drag options to blanks, or click blank then click option'

AMANAGER

B==

Cdepartment

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'USER' role instead of 'MANAGER'

Using '!=' operator which denies access when departments match

Using wrong property name instead of 'department'

The method restricts access to users with 'MANAGER' role and matching department, so the role is 'MANAGER', the operator is '==', and the property is 'department'.