Role-based access control in Spring Boot - Step-by-Step Execution

Concept Flow - Role-based access control

User sends request

↓

Spring Security intercepts

↓

Check user authentication

Yes↓

Check user roles

↓

Role matches

↓

Allow access

↓

Send response

The flow shows how Spring Security checks if a user is authenticated and has the right role before allowing access.

Execution Sample

Spring Boot

@PreAuthorize("hasRole('ADMIN')")
public String adminPage() {
  return "Admin content";
}

This code allows only users with the ADMIN role to access the adminPage method.

Execution Table

Step	Action	User Role	Check	Result	Access Outcome
1	User sends request to adminPage	USER	Is user authenticated?	Yes	Continue
2	Check if user has ADMIN role	USER	Does user have ADMIN role?	No	Access Denied
3	User sends request to adminPage	ADMIN	Is user authenticated?	Yes	Continue
4	Check if user has ADMIN role	ADMIN	Does user have ADMIN role?	Yes	Access Granted

💡 Access denied if user lacks ADMIN role; access granted only if role matches.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
User Role	None	USER	USER	ADMIN	ADMIN	ADMIN
Access Outcome	None	Pending	Denied	Pending	Granted	Granted

Key Moments - 2 Insights

Why does a user with role USER get denied access even if authenticated?

Because the role check in step 2 fails as USER role does not match required ADMIN role, so access is denied.

What happens if the user is not authenticated?

Spring Security blocks access before role check; authentication is required first as shown in step 1.

Visual Quiz - 3 Questions

Look at the execution table, what is the access outcome at step 2 for a USER role?

A Pending

B Access Granted

C Access Denied

D Authentication Failed

💡 Hint

Check the 'Access Outcome' column at step 2 in the execution_table.

At which step does the system confirm the user has the ADMIN role?

A Step 4

B Step 2

C Step 1

D Step 3

💡 Hint

Look for the role check result 'Yes' for ADMIN role in the execution_table.

If the user role changed from USER to ADMIN at step 2, how would the access outcome change?

A It would remain Access Denied

B It would change to Access Granted

C It would become Pending

D Authentication would fail

💡 Hint

Refer to the variable_tracker and execution_table rows where ADMIN role leads to Access Granted.

Concept Snapshot

Role-based access control in Spring Boot:
- Use @PreAuthorize("hasRole('ROLE_NAME')") to restrict methods.
- Spring Security checks authentication first.
- Then it checks if user has required role.
- Access is granted only if role matches.
- Otherwise, access is denied.

Full Transcript

Role-based access control in Spring Boot works by intercepting user requests with Spring Security. First, it checks if the user is authenticated. If not, access is blocked immediately. If authenticated, it checks the user's roles against the required role for the resource or method. For example, a method annotated with @PreAuthorize("hasRole('ADMIN')") allows only users with the ADMIN role. If the user has the role, access is granted; otherwise, it is denied. This ensures only authorized users can access protected parts of the application.