@PreAuthorize annotation in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to restrict access to the method only to users with the role 'ADMIN'.

Spring Boot

@PreAuthorize("hasRole('[1]')")
public void adminOnlyMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AADMIN

BMANAGER

CGUEST

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using a role name that does not exist in the system.

Forgetting to wrap the role name in quotes inside hasRole.

The @PreAuthorize annotation uses hasRole('ROLE_NAME') to restrict access. Here, only users with the role ADMIN can access the method.

2fill in blank

medium

Complete the code to allow access only if the user has the authority 'WRITE_PRIVILEGE'.

Spring Boot

@PreAuthorize("hasAuthority('[1]')")
public void writeData() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AWRITE_PRIVILEGE

BREAD_PRIVILEGE

CDELETE_PRIVILEGE

DEXECUTE_PRIVILEGE

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing roles with authorities.

Using an authority that the user does not have.

The hasAuthority expression checks if the user has a specific permission or authority. Here, only users with WRITE_PRIVILEGE can access the method.

3fill in blank

hard

Fix the error in the code to correctly restrict access to users with role 'MANAGER'.

Spring Boot

@PreAuthorize("hasRole([1])")
public void managerTask() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AMANAGER

B"MANAGER"

CROLE_MANAGER

D'MANAGER'

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the role name.

Using double quotes inside double quotes without escaping.

The role name must be a string literal inside quotes in the hasRole expression. Using single quotes 'MANAGER' is correct.

4fill in blank

hard

Fill both blanks to restrict access to users who have either 'ADMIN' role or 'WRITE_PRIVILEGE' authority.

Spring Boot

@PreAuthorize("[1] or [2]")
public void adminOrWriteAccess() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AhasRole('ADMIN')

BhasAuthority('READ_PRIVILEGE')

ChasAuthority('WRITE_PRIVILEGE')

DhasRole('USER')

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up roles and authorities in the expression.

Using 'and' instead of 'or' when both conditions are alternatives.

The expression uses hasRole('ADMIN') or hasAuthority('WRITE_PRIVILEGE') to allow access if either condition is true.

5fill in blank

hard

Fill all three blanks to restrict access to users with role 'USER' and authority 'READ_PRIVILEGE', but not with role 'GUEST'.

Spring Boot

@PreAuthorize("[1] and [2] and not [3]")
public void userReadAccess() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AhasRole('USER')

BhasAuthority('READ_PRIVILEGE')

ChasRole('GUEST')

DhasAuthority('WRITE_PRIVILEGE')

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting to use not for exclusion.

Mixing roles and authorities incorrectly.

The expression ensures the user has the USER role and READ_PRIVILEGE authority, but excludes users with the GUEST role.

Practice

1. What is the main purpose of the @PreAuthorize annotation in Spring Boot?

easy

A. To inject dependencies into a method

B. To log method execution time automatically

C. To restrict access to methods based on user roles or permissions before execution

D. To handle exceptions thrown by a method

Solution

1. Step 1: Understand the role of @PreAuthorize

   This annotation is used to check if a user has the right role or permission before allowing method execution.

2. Step 2: Compare with other options

   Logging, dependency injection, and exception handling are unrelated to @PreAuthorize.

3. Final Answer:

   To restrict access to methods based on user roles or permissions before execution -> Option C

4. Quick Check:

   Access control = A [OK]

Hint: Remember: @PreAuthorize controls access before method runs [OK]

Common Mistakes:

• Confusing @PreAuthorize with logging or exception handling
• Thinking it injects dependencies
• Assuming it runs after method execution

2. Which of the following is the correct syntax to allow only users with role 'ADMIN' to access a method using @PreAuthorize?

easy

A. @PreAuthorize("denyAll()")

B. @PreAuthorize("hasRole('ADMIN')")

C. @PreAuthorize("permitAll()")

D. @PreAuthorize("hasAuthority('USER')")

Solution

1. Step 1: Identify the correct expression for role checking

   The expression hasRole('ADMIN') checks if the user has the 'ADMIN' role.

2. Step 2: Verify other options

   hasAuthority('USER') checks for a different role, permitAll() allows everyone, and denyAll() denies everyone.

3. Final Answer:

   @PreAuthorize("hasRole('ADMIN')") -> Option B

4. Quick Check:

   Role check syntax = D [OK]

Hint: Use hasRole('ROLE_NAME') to restrict by role [OK]

Common Mistakes:

• Using wrong role name or authority
• Confusing hasRole with hasAuthority
• Using permitAll() when restriction is needed

3. Given the method below, what will happen if a user with role 'USER' calls it?

@PreAuthorize("hasRole('ADMIN')")
public String adminOnly() {
    return "Welcome Admin";
}

medium

A. Access denied error is thrown before method runs

B. The method executes and returns 'Welcome Admin'

C. The method executes but returns null

D. The method executes and returns 'Welcome User'

Solution

1. Step 1: Understand the role restriction

   The method requires the user to have 'ADMIN' role to run.

2. Step 2: Check user role and effect

   User has 'USER' role, not 'ADMIN', so access is denied before method runs.

3. Final Answer:

   Access denied error is thrown before method runs -> Option A

4. Quick Check:

   Role mismatch causes denial = A [OK]

Hint: If role missing, @PreAuthorize blocks method [OK]

Common Mistakes:

• Assuming method runs anyway
• Thinking it returns null instead of error
• Confusing roles 'USER' and 'ADMIN'

4. Identify the error in this usage of @PreAuthorize:

@PreAuthorize("hasRole(ADMIN)")
public void secureMethod() { }

medium

A. Annotation should be @PostAuthorize instead

B. Method must return a value to use @PreAuthorize

C. No error, syntax is correct

D. Missing quotes around 'ADMIN' in hasRole expression

Solution

1. Step 1: Check syntax of hasRole expression

   The role name must be a string inside quotes: hasRole('ADMIN').

2. Step 2: Verify other options

   Return type is not required, @PreAuthorize is correct annotation, so no other errors.

3. Final Answer:

   Missing quotes around 'ADMIN' in hasRole expression -> Option D

4. Quick Check:

   Role names need quotes = C [OK]

Hint: Always put role names in quotes inside hasRole() [OK]

Common Mistakes:

• Omitting quotes around role names
• Confusing @PreAuthorize with @PostAuthorize
• Thinking method must return a value

5. How would you use @PreAuthorize to allow access only if the user has either 'ADMIN' role or 'MANAGER' authority?

hard

A. @PreAuthorize("hasRole('ADMIN') or hasAuthority('MANAGER')")

B. @PreAuthorize("hasRole('ADMIN') and hasAuthority('MANAGER')")

C. @PreAuthorize("hasRole('ADMIN')") @PreAuthorize("hasAuthority('MANAGER')")

D. @PreAuthorize("permitAll()")

Solution

1. Step 1: Understand logical operators in @PreAuthorize

   Use or to allow access if either condition is true.

2. Step 2: Analyze options

   @PreAuthorize("hasRole('ADMIN') or hasAuthority('MANAGER')") uses or correctly; @PreAuthorize("hasRole('ADMIN') and hasAuthority('MANAGER')") requires both roles which is stricter; @PreAuthorize("hasRole('ADMIN')") @PreAuthorize("hasAuthority('MANAGER')") is invalid to use two annotations; @PreAuthorize("permitAll()") allows everyone.

3. Final Answer:

   @PreAuthorize("hasRole('ADMIN') or hasAuthority('MANAGER')") -> Option A

4. Quick Check:

   Use 'or' for either role or authority = B [OK]

Hint: Combine roles with 'or' inside one @PreAuthorize [OK]

Common Mistakes:

• Using 'and' instead of 'or' when either role suffices
• Trying to stack multiple @PreAuthorize annotations
• Using permitAll() which allows everyone