Role-based access control in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the role required to access the method.

Spring Boot

@PreAuthorize("hasRole('[1]')")
public void adminOnlyMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AADMIN

BMANAGER

CGUEST

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using a role that does not exist in the system.

Forgetting to use uppercase for role names.

The @PreAuthorize annotation checks if the user has the specified role. Here, ADMIN is the role required.

2fill in blank

medium

Complete the code to define a method accessible only by users with the 'USER' role.

Spring Boot

@PreAuthorize("hasRole('[1]')")
public String userDashboard() {
    return "Welcome User";
}

Drag options to blanks, or click blank then click option'

AADMIN

BUSER

CGUEST

DMODERATOR

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ADMIN' role instead of 'USER'.

Misspelling the role name.

The method is restricted to users with the USER role using @PreAuthorize.

3fill in blank

hard

Fix the error in the annotation to correctly check for the 'MANAGER' role.

Spring Boot

@PreAuthorize("hasRole([1])")
public void managerTask() {
    // task logic
}

Drag options to blanks, or click blank then click option'

A'MANAGER'

BMANAGER

C"MANAGER"

Dmanager

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the role name.

Using single quotes instead of double quotes inside the annotation.

The role name must be a string inside double quotes within the annotation expression.

4fill in blank

hard

Fill both blanks to create a method accessible by either 'ADMIN' or 'MODERATOR' roles.

Spring Boot

@PreAuthorize("hasRole('[1]') or hasRole('[2]')")
public void adminOrModTask() {
    // logic here
}

Drag options to blanks, or click blank then click option'

AADMIN

BUSER

CMODERATOR

DGUEST

Attempts:

3 left

💡 Hint

Common Mistakes

Using roles that are too general like 'USER' or 'GUEST'.

Forgetting to add both roles in the expression.

The method allows access if the user has either the ADMIN or MODERATOR role.

5fill in blank

hard

Fill all three blanks to create a method that allows access only if the user has 'ADMIN' role and the resource owner matches the current user.

Spring Boot

@PreAuthorize("hasRole('[1]') and #[2].owner == authentication.name")
public void secureResourceAccess(Resource [2]) {
    System.out.println([3].getId());
}

Drag options to blanks, or click blank then click option'

AADMIN

Bres

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names in parameter and method body.

Using a role other than 'ADMIN' for this strict check.

The method requires the ADMIN role and checks if the resource owner matches the logged-in user. The parameter and usage use res as the variable name.