Role-based access control in Spring Boot - Mini Project: Build & Apply

Role-based access control

📖 Scenario: You are building a simple Spring Boot web application that restricts access to certain pages based on user roles. For example, only users with the ADMIN role can access the admin page.

🎯 Goal: Create a Spring Boot controller with role-based access control using annotations. You will define user roles, configure access rules, and secure endpoints so only authorized roles can access them.

📋 What You'll Learn

Create a controller class named DashboardController

Define two endpoints: /user and /admin

Allow access to /user for users with role USER

Allow access to /admin for users with role ADMIN

Use Spring Security annotations to enforce role-based access control

💡 Why This Matters

🌍 Real World

Role-based access control is essential in web apps to protect sensitive pages and data by allowing only authorized users to access them.

💼 Career

Understanding how to implement role-based security in Spring Boot is a key skill for backend developers working on secure enterprise applications.

1

Create the controller class with user endpoint

Create a Spring Boot controller class named DashboardController. Inside it, create a method userDashboard mapped to /user that returns the string User Dashboard.

Spring Boot

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class DashboardController {
    // Your code here
}

Hint

Use @RestController on the class and @GetMapping("/user") on the method.

2

Add admin endpoint to the controller

In the DashboardController class, add a method adminDashboard mapped to /admin that returns the string Admin Dashboard.

Spring Boot

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class DashboardController {
    @GetMapping("/user")
    public String userDashboard() {
        return "User Dashboard";
    }

    // Your code here
}

Hint

Add a new method with @GetMapping("/admin") that returns Admin Dashboard.

3

Add role-based access control annotations

Add Spring Security annotations to restrict access: annotate userDashboard with @PreAuthorize("hasRole('USER')") and adminDashboard with @PreAuthorize("hasRole('ADMIN')"). Import org.springframework.security.access.prepost.PreAuthorize.

Spring Boot

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.security.access.prepost.PreAuthorize;

@RestController
public class DashboardController {
    @GetMapping("/user")
    // Add @PreAuthorize for USER role
    public String userDashboard() {
        return "User Dashboard";
    }

    @GetMapping("/admin")
    // Add @PreAuthorize for ADMIN role
    public String adminDashboard() {
        return "Admin Dashboard";
    }
}

Hint

Use @PreAuthorize above each method to specify the required role.

4

Enable method security in the application

In your Spring Boot application main class, add the annotation @EnableMethodSecurity to enable method-level security. Import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity.

Spring Boot

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@SpringBootApplication
// Add @EnableMethodSecurity here
public class DemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }
}

Hint

Add @EnableMethodSecurity above your main application class to activate method security.

Practice

1. What is the main purpose of role-based access control (RBAC) in a Spring Boot application?

easy

A. To restrict access to resources based on user roles

B. To improve application performance by caching data

C. To automatically generate user interfaces

D. To handle database transactions efficiently

Solution

1. Step 1: Understand RBAC concept

   RBAC limits access to parts of an application depending on the roles assigned to users.

2. Step 2: Identify the purpose in Spring Boot

   In Spring Boot, RBAC is used to protect resources by checking user roles before allowing access.

3. Final Answer:

   To restrict access to resources based on user roles -> Option A

4. Quick Check:

   RBAC controls access by roles = A [OK]

Hint: RBAC controls who can do what by roles [OK]

Common Mistakes:

• Confusing RBAC with performance optimization
• Thinking RBAC generates UI automatically
• Mixing RBAC with database transaction handling

2. Which annotation is used in Spring Boot to enforce role-based access control on a method?

easy

A. @PreAuthorize

B. @Autowired

C. @RequestMapping

D. @Entity

Solution

1. Step 1: Identify role enforcement annotation

   Spring Security uses @PreAuthorize to check roles before method execution.

2. Step 2: Differentiate from other annotations

   @RequestMapping handles URL mapping, @Autowired injects beans, @Entity marks database entities.

3. Final Answer:

   @PreAuthorize -> Option A

4. Quick Check:

   @PreAuthorize controls access by roles [OK]

Hint: Use @PreAuthorize to check roles on methods [OK]

Common Mistakes:

• Using @RequestMapping for access control
• Confusing @Autowired with security annotations
• Mistaking @Entity for access control

3. Given the method annotation @PreAuthorize("hasRole('ADMIN')"), what will happen if a user with role USER tries to access this method?

medium

A. Access is granted because USER is a valid role

B. Method throws a syntax error

C. Access is denied because the user lacks ADMIN role

D. Access is granted only if the user is authenticated

Solution

1. Step 1: Understand the @PreAuthorize expression

   The expression requires the user to have the ADMIN role to access the method.

2. Step 2: Check user role against requirement

   A user with only USER role does not meet the ADMIN role requirement, so access is denied.

3. Final Answer:

   Access is denied because the user lacks ADMIN role -> Option C

4. Quick Check:

   Role check fails without ADMIN role = B [OK]

Hint: User must have exact role in @PreAuthorize to access [OK]

Common Mistakes:

• Assuming any authenticated user can access
• Thinking USER role is enough for ADMIN-only methods
• Confusing syntax error with access denial

4. Consider this method in a Spring Boot controller:

@PreAuthorize("hasRole('ADMIN')")
public String adminPage() {
    return "Welcome Admin";
}

What is the likely cause if users with ADMIN role still get access denied errors?

medium

A. The method must be static to work with @PreAuthorize

B. The role prefix 'ROLE_' is missing in the role check

C. The return type should be ResponseEntity<String>

D. The method should be annotated with @GetMapping instead

Solution

1. Step 1: Understand Spring Security role prefix

   Spring Security by default adds 'ROLE_' prefix to roles internally.

2. Step 2: Check role naming in @PreAuthorize

   Using hasRole('ADMIN') expects the granted authority to be 'ROLE_ADMIN'. If roles lack this prefix, access is denied.

3. Final Answer:

   The role prefix 'ROLE_' is missing in the role check -> Option B

4. Quick Check:

   Missing 'ROLE_' prefix causes access denial = D [OK]

Hint: Remember Spring Security adds 'ROLE_' prefix by default [OK]

Common Mistakes:

• Thinking @GetMapping affects access control
• Believing return type affects security
• Assuming method must be static for @PreAuthorize

5. You want to restrict access to a service method so that only users with either ADMIN or MANAGER roles can call it. Which @PreAuthorize expression correctly enforces this?

hard

A. @PreAuthorize("hasRole('ADMIN,MANAGER')")

B. @PreAuthorize("hasRole('ADMIN', 'MANAGER')")

C. @PreAuthorize("hasRole('ADMIN') and hasRole('MANAGER')")

D. @PreAuthorize("hasAnyRole('ADMIN', 'MANAGER')")

Solution

1. Step 1: Understand role checks for multiple roles

   To allow access if user has either ADMIN or MANAGER, use hasAnyRole('ADMIN', 'MANAGER').

2. Step 2: Analyze each option

   @PreAuthorize("hasRole('ADMIN') and hasRole('MANAGER')") requires both roles (AND), which is too strict. @PreAuthorize("hasRole('ADMIN', 'MANAGER')") is invalid as hasRole accepts only one role. @PreAuthorize("hasAnyRole('ADMIN', 'MANAGER')") uses hasAnyRole which is concise and correct. @PreAuthorize("hasRole('ADMIN,MANAGER')") is invalid syntax.

3. Final Answer:

   @PreAuthorize("hasAnyRole('ADMIN', 'MANAGER')") -> Option D

4. Quick Check:

   Use hasAnyRole for multiple allowed roles = A [OK]

Hint: Use hasAnyRole for OR conditions on roles [OK]

Common Mistakes:

• Using AND instead of OR for multiple roles
• Passing multiple roles as a single string
• Not using hasAnyRole for multiple roles