@Secured annotation in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a method annotated with @Secured is accessed by an unauthorized user?

Consider a Spring Boot method annotated with @Secured("ROLE_ADMIN"). What is the expected behavior if a user without the ROLE_ADMIN role tries to access this method?

Spring Boot

import org.springframework.security.access.annotation.Secured;

public class AdminService {
    @Secured("ROLE_ADMIN")
    public String getAdminData() {
        return "Sensitive Admin Data";
    }
}

A Spring Security throws an AccessDeniedException preventing method execution.

B The method executes normally and returns the data regardless of user role.

C The method returns null without throwing any exception.

D The application crashes with a NullPointerException.

💡 Hint

Think about how Spring Security enforces role-based access control.

The @Secured annotation restricts method access to users with specified roles. If a user lacks the required role, Spring Security throws an AccessDeniedException to prevent unauthorized access.

📝 Syntax

intermediate

Which of the following is the correct way to use @Secured for multiple roles?

Choose the correct syntax to allow access to a method for users with either ROLE_USER or ROLE_ADMIN using @Secured.

A @Secured("ROLE_USER" || "ROLE_ADMIN")

B @Secured("ROLE_USER, ROLE_ADMIN")

C @Secured({"ROLE_USER", "ROLE_ADMIN"})

D @Secured(["ROLE_USER", "ROLE_ADMIN"])

💡 Hint

Remember that @Secured accepts an array of strings.

The @Secured annotation expects an array of role names as strings. The correct syntax uses curly braces to define the array: @Secured({"ROLE_USER", "ROLE_ADMIN"}).

🔧 Debug

advanced

Why does @Secured annotation not restrict access as expected?

A developer added @Secured("ROLE_ADMIN") to a method, but users without ROLE_ADMIN can still access it. What is the most likely cause?

Spring Boot

import org.springframework.security.access.annotation.Secured;

public class ReportService {
    @Secured("ROLE_ADMIN")
    public String generateReport() {
        return "Report Data";
    }
}

A The method is private, so <code>@Secured</code> does not apply.

B The <code>@EnableGlobalMethodSecurity(securedEnabled = true)</code> annotation is missing in the configuration.

C The user roles are case-sensitive and should be lowercase.

D The <code>@Secured</code> annotation requires a <code>@Transactional</code> annotation to work.

💡 Hint

Check if method security is enabled in the Spring Security configuration.

For @Secured annotations to work, method security must be enabled by adding @EnableGlobalMethodSecurity(securedEnabled = true) in the configuration class. Without this, the annotations are ignored.

❓ state_output

advanced

What is the output when a user with ROLE_USER calls a method annotated with @Secured({"ROLE_USER", "ROLE_ADMIN"})?

Given the method below, what will be the output if a user with only ROLE_USER calls it?

Spring Boot

import org.springframework.security.access.annotation.Secured;

public class DataService {
    @Secured({"ROLE_USER", "ROLE_ADMIN"})
    public String fetchData() {
        return "Data fetched successfully";
    }
}

A "Data fetched successfully"

B NullPointerException is thrown

C AccessDeniedException is thrown

D "Access denied" string is returned

💡 Hint

Check if the user's role matches any role in the annotation.

The @Secured annotation allows access if the user has any one of the specified roles. Since the user has ROLE_USER, the method executes and returns the string.

🧠 Conceptual

expert

Why might you choose @PreAuthorize over @Secured in Spring Security?

Both @Secured and @PreAuthorize annotations can restrict method access. What is a key advantage of using @PreAuthorize?

A <code>@PreAuthorize</code> automatically logs access attempts.

B <code>@PreAuthorize</code> is faster at runtime than <code>@Secured</code>.

C <code>@PreAuthorize</code> does not require enabling method security in configuration.

D <code>@PreAuthorize</code> supports complex SpEL expressions for fine-grained access control.

💡 Hint

Think about flexibility in defining access rules.

@PreAuthorize allows using Spring Expression Language (SpEL) to write complex access rules, such as checking method parameters or combining roles with logical operators, which @Secured cannot do.