@PreAuthorize annotation in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to restrict access to the method only to users with the role 'ADMIN'.

Spring Boot

@PreAuthorize("hasRole('[1]')")
public void adminOnlyMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AADMIN

BMANAGER

CGUEST

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using a role name that does not exist in the system.

Forgetting to wrap the role name in quotes inside hasRole.

The @PreAuthorize annotation uses hasRole('ROLE_NAME') to restrict access. Here, only users with the role ADMIN can access the method.

2fill in blank

medium

Complete the code to allow access only if the user has the authority 'WRITE_PRIVILEGE'.

Spring Boot

@PreAuthorize("hasAuthority('[1]')")
public void writeData() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AWRITE_PRIVILEGE

BREAD_PRIVILEGE

CDELETE_PRIVILEGE

DEXECUTE_PRIVILEGE

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing roles with authorities.

Using an authority that the user does not have.

The hasAuthority expression checks if the user has a specific permission or authority. Here, only users with WRITE_PRIVILEGE can access the method.

3fill in blank

hard

Fix the error in the code to correctly restrict access to users with role 'MANAGER'.

Spring Boot

@PreAuthorize("hasRole([1])")
public void managerTask() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AMANAGER

B"MANAGER"

CROLE_MANAGER

D'MANAGER'

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the role name.

Using double quotes inside double quotes without escaping.

The role name must be a string literal inside quotes in the hasRole expression. Using single quotes 'MANAGER' is correct.

4fill in blank

hard

Fill both blanks to restrict access to users who have either 'ADMIN' role or 'WRITE_PRIVILEGE' authority.

Spring Boot

@PreAuthorize("[1] or [2]")
public void adminOrWriteAccess() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AhasRole('ADMIN')

BhasAuthority('READ_PRIVILEGE')

ChasAuthority('WRITE_PRIVILEGE')

DhasRole('USER')

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up roles and authorities in the expression.

Using 'and' instead of 'or' when both conditions are alternatives.

The expression uses hasRole('ADMIN') or hasAuthority('WRITE_PRIVILEGE') to allow access if either condition is true.

5fill in blank

hard

Fill all three blanks to restrict access to users with role 'USER' and authority 'READ_PRIVILEGE', but not with role 'GUEST'.

Spring Boot

@PreAuthorize("[1] and [2] and not [3]")
public void userReadAccess() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AhasRole('USER')

BhasAuthority('READ_PRIVILEGE')

ChasRole('GUEST')

DhasAuthority('WRITE_PRIVILEGE')

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting to use not for exclusion.

Mixing roles and authorities incorrectly.

The expression ensures the user has the USER role and READ_PRIVILEGE authority, but excludes users with the GUEST role.