@Secured annotation in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the @Secured annotation in Spring Boot?

The @Secured annotation is used to specify security roles that are allowed to access a method or class. It restricts access based on user roles.

beginner

How do you specify multiple roles with @Secured?

You provide an array of role names inside @Secured, like @Secured({"ROLE_ADMIN", "ROLE_USER"}). The method is accessible if the user has any one of these roles.

beginner

Where can you place the @Secured annotation in your code?

You can place @Secured on methods or on classes. When placed on a class, it applies to all methods inside that class.

intermediate

What must be enabled in Spring Security configuration to use @Secured annotations?

You must enable method security by adding @EnableMethodSecurity(securedEnabled = true) in your configuration class.

intermediate

What happens if a user without the required role tries to access a method annotated with @Secured?

Spring Security will deny access and throw an AccessDeniedException, usually resulting in a 403 Forbidden HTTP response.

What does @Secured({"ROLE_ADMIN"}) mean?

A Only users with ROLE_ADMIN can access the method

B All users can access the method

C Users with any role can access the method

D It disables security for the method

The annotation restricts access to users who have the ROLE_ADMIN authority.

Where do you enable support for @Secured annotations in Spring Boot?

A In the controller class only

B In the application.properties file

C No configuration needed

D In the main application class with <code>@EnableMethodSecurity(securedEnabled = true)</code>

You must enable method security with @EnableMethodSecurity(securedEnabled = true) to use @Secured.

If @Secured is placed on a class, what happens?

A It applies only to methods with <code>@RequestMapping</code>

B It applies to all methods in the class

C It applies only to the constructor

D It has no effect

The annotation secures all methods inside the class.

Can @Secured accept multiple roles?

A Yes, but only comma-separated string

B No, only one role is allowed

C Yes, as an array of role names

D No, roles are defined elsewhere

@Secured accepts an array like {"ROLE_USER", "ROLE_ADMIN"}.

What exception is thrown if access is denied by @Secured?

A AccessDeniedException

B NullPointerException

C IllegalArgumentException

D AuthenticationException

Spring Security throws AccessDeniedException when a user lacks required roles.

Explain how the @Secured annotation controls access in a Spring Boot application.

Think about who can use the method and what happens if they can't.

Describe the steps to secure a method using @Secured in Spring Boot.

Consider configuration and annotation placement.