@PreAuthorize annotation in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the @PreAuthorize annotation in Spring Boot?

The @PreAuthorize annotation is used to check if a user has the required permissions before allowing access to a method. It helps secure methods by defining access rules using expressions.

beginner

How do you enable the use of @PreAuthorize annotations in a Spring Boot application?

You enable @PreAuthorize by adding @EnableMethodSecurity (or @EnableGlobalMethodSecurity(prePostEnabled = true) in older versions) to a configuration class. This activates method-level security checks.

intermediate

What kind of expressions can you use inside @PreAuthorize?

You can use Spring Expression Language (SpEL) expressions like hasRole('ADMIN'), hasAuthority('permission'), or complex logical expressions combining roles and permissions.

beginner

Example: What does @PreAuthorize("hasRole('ADMIN')") do?

It allows only users with the role ADMIN to access the annotated method. If the user lacks this role, access is denied before the method runs.

intermediate

Can @PreAuthorize check conditions based on method parameters?

Yes, @PreAuthorize can use method parameters in expressions, for example: @PreAuthorize("#userId == authentication.principal.id") to allow access only if the user ID matches the logged-in user.

What annotation must be added to enable @PreAuthorize in Spring Boot?

A <code>@EnableMethodSecurity</code>

B <code>@EnableWebSecurity</code>

C <code>@SpringBootApplication</code>

D <code>@ComponentScan</code>

@EnableMethodSecurity activates method-level security including @PreAuthorize.

Which expression checks if a user has the role 'USER' inside @PreAuthorize?

A hasRole('USER')

B hasAuthority('USER')

C isAuthenticated()

D permitAll()

hasRole('USER') checks if the user has the role named USER.

What happens if a user fails the @PreAuthorize check?

A Method runs but returns null

B Access is denied and method is not executed

C User is redirected automatically

D Method runs with limited permissions

If the @PreAuthorize condition is false, access is denied and the method does not run.

Can @PreAuthorize use method parameters in its expression?

A Only if parameters are primitive types

B No, it only checks user roles

C Yes, using parameter names with #

D Only in controller classes

You can reference method parameters by name with a # prefix inside @PreAuthorize.

Which of these is a valid @PreAuthorize expression?

A isAnonymous() or hasAuthority('USER')

B permitAll()

C allUsers()

D hasRole('ADMIN') and #id == authentication.principal.id

You can combine role checks and parameter checks with logical operators in @PreAuthorize.

Explain how the @PreAuthorize annotation secures a method in Spring Boot.

Think about how you stop someone from entering a room unless they have a key.

Describe how you would restrict a method to only allow access to users with a specific role and matching user ID parameter.

Combine role check and parameter check in one expression.