Role-based access control in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Role-based Access Control (RBAC)?

RBAC is a way to control who can do what in an application by assigning roles to users. Each role has specific permissions that allow or deny actions.

beginner

How do you define roles in Spring Boot for RBAC?

Roles are usually defined as strings like 'ROLE_ADMIN' or 'ROLE_USER' and assigned to users. Spring Security uses these roles to check access rights.

intermediate

Which Spring Security annotation is used to restrict access to methods based on roles?

The @PreAuthorize annotation is used to restrict access by specifying role conditions, for example, @PreAuthorize("hasRole('ADMIN')").

intermediate

What is the difference between 'hasRole' and 'hasAuthority' in Spring Security?

'hasRole' checks for roles with a 'ROLE_' prefix automatically added, while 'hasAuthority' checks for exact authority strings without adding prefixes.

intermediate

How can you configure role-based access control in Spring Security's HttpSecurity?

You configure RBAC by specifying URL patterns and the roles allowed to access them using methods like .antMatchers("/admin/**").hasRole("ADMIN").

In Spring Security, what prefix is automatically added when using hasRole('ADMIN')?

A ROLE_

B AUTH_

C PERM_

D USER_

Spring Security automatically adds the prefix 'ROLE_' when you use hasRole, so hasRole('ADMIN') checks for 'ROLE_ADMIN'.

Which annotation restricts method access based on roles in Spring Boot?

A @PreAuthorize

B @GetMapping

C @Autowired

D @Component

@PreAuthorize allows you to specify role-based access rules on methods.

What does RBAC stand for?

A Role-based Authentication Code

B Resource-based Access Control

C Role-based Access Control

D Resource Binding Access Control

RBAC means Role-based Access Control, a way to manage permissions by roles.

How do you specify that only users with ADMIN role can access '/admin/**' URLs in Spring Security?

A .antMatchers("/admin/**").permitAll()

B .antMatchers("/admin/**").authenticated()

C .antMatchers("/admin/**").denyAll()

D .antMatchers("/admin/**").hasRole("ADMIN")

Using .antMatchers("/admin/**").hasRole("ADMIN") restricts access to users with ADMIN role.

Which of these is NOT a typical role name in Spring Security?

A ROLE_USER

B ROLE_GUEST_USER

C ROLE_MANAGER

D ROLE_ADMIN

While ROLE_GUEST_USER could be used, it is uncommon to have spaces or underscores beyond simple role names; typical roles are short and simple.

Explain how role-based access control works in a Spring Boot application.

Think about how you decide who can enter a room based on their badge.

Describe how to restrict access to a REST endpoint to only users with the ADMIN role using Spring Security.

Consider both configuration and annotation ways.