@PreAuthorize annotation in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without the required role accesses a method annotated with @PreAuthorize?

Consider a Spring Boot method annotated with @PreAuthorize("hasRole('ADMIN')"). What is the behavior if a user with role USER tries to call this method?

Spring Boot

public class MyService {
    @PreAuthorize("hasRole('ADMIN')")
    public String adminOnlyMethod() {
        return "Secret Data";
    }
}

A The method returns null without executing the logic.

B The method executes but returns an empty string.

C The method throws an AccessDeniedException and does not execute.

D The method executes normally and returns "Secret Data".

💡 Hint

Think about what Spring Security does when authorization fails.

The @PreAuthorize annotation checks the user's roles before method execution. If the user lacks the required role, Spring Security throws an AccessDeniedException and prevents the method from running.

📝 Syntax

intermediate

Which @PreAuthorize expression correctly checks if the user has either ROLE_ADMIN or ROLE_MANAGER?

Choose the correct @PreAuthorize expression to allow access if the user has ROLE_ADMIN or ROLE_MANAGER.

A @PreAuthorize("hasAnyRole('ADMIN', 'MANAGER')")

B @PreAuthorize("hasRole('ADMIN' && 'MANAGER')")

C @PreAuthorize("hasRole('ADMIN') && hasRole('MANAGER')")

D @PreAuthorize("hasRole('ADMIN') or hasRole('MANAGER')")

💡 Hint

Look for the expression that checks multiple roles correctly.

The hasAnyRole expression checks if the user has at least one of the listed roles. Using or with separate hasRole calls also works, but hasAnyRole is cleaner and correct. The other options have syntax errors or wrong logic.

❓ state_output

advanced

What is the output when a method annotated with @PreAuthorize uses a SpEL expression referencing method parameters?

Given the method below, what will be the output if the user has username "alice" and calls getUserData("alice")?

Spring Boot

public class UserService {
    @PreAuthorize("#username == authentication.name")
    public String getUserData(String username) {
        return "Data for " + username;
    }
}

A "Data for null" is returned because username is not passed correctly.

B AccessDeniedException is thrown because the expression is invalid.

C NullPointerException occurs due to missing authentication object.

D "Data for alice" is returned because the username matches authentication name.

💡 Hint

Check how SpEL accesses method parameters and authentication info.

The SpEL expression #username == authentication.name compares the method parameter username with the current authenticated user's name. If they match, access is granted and the method returns the expected string.

🔧 Debug

advanced

Why does this @PreAuthorize expression cause a syntax error?

Identify the problem in this annotation:

@PreAuthorize("hasRole('ADMIN') and hasPermission(#id, 'read')")

A The hasPermission function requires three arguments, so this is incomplete.

B The expression uses 'and' instead of '&&' which causes a syntax error.

C The method parameter #id is not accessible in the expression.

D The expression is valid and causes no syntax error.

💡 Hint

Check the logical operators allowed in SpEL expressions.

In SpEL, logical AND must be written as &&, not and. Using and causes a syntax error.

🧠 Conceptual

expert

How does @PreAuthorize differ from @PostAuthorize in Spring Security?

Choose the statement that best describes the difference between @PreAuthorize and @PostAuthorize.

A <code>@PreAuthorize</code> checks authorization before method execution; <code>@PostAuthorize</code> checks after method execution and can use the method's return value.

B <code>@PreAuthorize</code> is used only for roles; <code>@PostAuthorize</code> is used only for permissions.

C Both annotations check authorization only before method execution but differ in syntax.

D <code>@PreAuthorize</code> checks authorization after method execution; <code>@PostAuthorize</code> checks before method execution.

💡 Hint

Think about when the security check happens relative to the method call.

@PreAuthorize runs before the method to decide if it should run. @PostAuthorize runs after the method and can check the returned data to decide if access is allowed.