Role-based access control in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when accessing a secured endpoint without the required role?

Consider a Spring Boot REST controller method secured with @PreAuthorize("hasRole('ADMIN')"). What happens if a user without the ADMIN role tries to access this endpoint?

Spring Boot

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class AdminController {
    @GetMapping("/admin/data")
    @PreAuthorize("hasRole('ADMIN')")
    public String getAdminData() {
        return "Sensitive admin data";
    }
}

A The user receives HTTP 403 Forbidden error.

B The user receives HTTP 401 Unauthorized error.

C The user receives HTTP 404 Not Found error.

D The user receives the string "Sensitive admin data".

💡 Hint

Think about what HTTP status code means 'access denied' due to insufficient permissions.

When a user is authenticated but lacks the required role, Spring Security returns HTTP 403 Forbidden. HTTP 401 is for unauthenticated users.

📝 Syntax

intermediate

Which annotation correctly restricts access to users with role USER or ADMIN?

In Spring Security, which @PreAuthorize expression correctly allows access only to users with role USER or ADMIN?

A @PreAuthorize("hasRole('USER') or hasRole('ADMIN')")

B @PreAuthorize("hasRole('USER') and hasRole('ADMIN')")

C @PreAuthorize("hasRole('USER', 'ADMIN')")

D @PreAuthorize("hasAnyRole('USER', 'ADMIN')")

💡 Hint

Look for the expression that checks for multiple roles in one call.

hasAnyRole('USER', 'ADMIN') allows access if the user has at least one of the listed roles. The other options are either invalid syntax or require both roles.

❓ state_output

advanced

What is the role of SecurityContextHolder in Spring Security?

After a user logs in, Spring Security stores authentication details. What does SecurityContextHolder.getContext().getAuthentication() return?

A An Authentication object containing the user's principal, credentials, and granted authorities.

B A boolean indicating if the user is authenticated.

C The user's password in plain text.

D A list of all users currently logged in.

💡 Hint

Think about what information Spring Security keeps about the current user.

The Authentication object holds the user's identity (principal), credentials (usually hidden), and roles (authorities). It does not expose passwords or user lists.

🔧 Debug

advanced

Why does this method allow access to all users despite @PreAuthorize annotation?

Given the following Spring Boot controller method, why does it allow access to users without the ADMIN role?

Spring Boot

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class SampleController {
    @GetMapping("/secure-data")
    @PreAuthorize("hasRole('ADMIN')")
    public String getData() {
        return "Secure Data";
    }
}

A The @PreAuthorize annotation is misspelled.

B The user actually has the ADMIN role but it is not visible.

C Method security is not enabled in the Spring Boot application.

D The endpoint URL is incorrect.

💡 Hint

Check if method security annotations are activated in the configuration.

Spring Security requires enabling method security with @EnableMethodSecurity or similar. Without it, @PreAuthorize annotations are ignored.

🧠 Conceptual

expert

How does Spring Security differentiate roles internally when using hasRole vs hasAuthority?

In Spring Security, what is the key difference between hasRole('ADMIN') and hasAuthority('ADMIN') in access control expressions?

A <code>hasAuthority</code> automatically prefixes the role name with 'ROLE_', while <code>hasRole</code> checks the exact authority string.

B <code>hasRole</code> automatically prefixes the role name with 'ROLE_', while <code>hasAuthority</code> checks the exact authority string.

C There is no difference; both check the exact same authority string.

D <code>hasRole</code> checks user permissions, <code>hasAuthority</code> checks user groups.

💡 Hint

Think about how Spring Security stores roles internally with prefixes.

Spring Security stores roles with a 'ROLE_' prefix internally. hasRole('ADMIN') checks for 'ROLE_ADMIN', while hasAuthority('ADMIN') checks for 'ADMIN' exactly.