@Secured annotation in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to secure the method so only users with role 'ADMIN' can access it.

Spring Boot

@Secured({"[1]"})
public void adminOnlyMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AROLE_ADMIN

BADMIN

CROLE_USER

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ADMIN' without 'ROLE_' prefix causes access to fail.

The @Secured annotation requires roles to be prefixed with 'ROLE_'. So to allow only admins, use 'ROLE_ADMIN'.

2fill in blank

medium

Complete the code to allow access to users with either 'USER' or 'ADMIN' roles.

Spring Boot

@Secured({"[1]", "ROLE_ADMIN"})
public void userOrAdminMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AGUEST

BROLE_USER

CROLE_GUEST

DUSER

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting 'ROLE_' prefix causes access denial.

To allow multiple roles, list them in @Secured. Roles must have 'ROLE_' prefix, so use 'ROLE_USER' and 'ROLE_ADMIN'.

3fill in blank

hard

Fix the error in the annotation to correctly secure the method for 'MANAGER' role.

Spring Boot

@Secured("[1]")
public void managerMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AMANAGER

B[ROLE_MANAGER]

CROLE_MANAGER

D{ROLE_MANAGER}

Attempts:

3 left

💡 Hint

Common Mistakes

Using brackets or missing 'ROLE_' prefix causes errors.

@Secured expects a string or array of strings with roles prefixed by 'ROLE_'. Use "ROLE_MANAGER" as a string.

4fill in blank

hard

Fill both blanks to secure the method for roles 'ADMIN' and 'SUPERVISOR'.

Spring Boot

@Secured({"[1]", "[2]"})
public void adminSupervisorMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AROLE_ADMIN

BROLE_SUPERVISOR

CADMIN

DSUPERVISOR

Attempts:

3 left

💡 Hint

Common Mistakes

Using roles without 'ROLE_' prefix or wrong syntax.

Use the @Secured annotation with an array of roles, each prefixed by 'ROLE_'.

5fill in blank

hard

Fill all three blanks to secure the method for roles 'USER', 'ADMIN', and 'GUEST'.

Spring Boot

@Secured({"[1]", "[2]", "[3]"})
public void multiRoleMethod() {
    // method logic
}

Drag options to blanks, or click blank then click option'

AROLE_GUEST

BROLE_ADMIN

CROLE_USER

DGUEST

Attempts:

3 left

💡 Hint

Common Mistakes

Missing 'ROLE_' prefix or incorrect array syntax.

List all roles with 'ROLE_' prefix inside the @Secured annotation array.

Practice

1.

What is the main purpose of the @Secured annotation in Spring Boot?

easy

A. To restrict access to methods based on user roles

B. To define database entity relationships

C. To configure application properties

D. To handle HTTP request mappings

Solution

1. Step 1: Understand the role of @Secured

   The @Secured annotation is used to limit method access to users with specific roles.

2. Step 2: Compare with other options

   Other options relate to different Spring features like database or HTTP handling, not security roles.

3. Final Answer:

   To restrict access to methods based on user roles -> Option A

4. Quick Check:

   @Secured controls method access by roles [OK]

Hint: Remember: @Secured controls who can run a method [OK]

Common Mistakes:

• Confusing @Secured with @RequestMapping
• Thinking @Secured configures database
• Assuming @Secured manages app properties

2.

Which of the following is the correct way to use @Secured to allow only users with role ADMIN to access a method?

@Secured({"?"})
public void adminMethod() { }

easy

A. ROLE_ADMIN

B. ADMIN

C. ROLE-ADMIN

D. ROLE_ADMINISTRATOR

Solution

1. Step 1: Recall role naming convention

   Spring Security requires roles to be prefixed with ROLE_, so ROLE_ADMIN is correct.

2. Step 2: Check other options

   ADMIN without prefix is invalid; ROLE-ADMIN uses wrong separator; ROLE_ADMINISTRATOR is a different role.

3. Final Answer:

   ROLE_ADMIN -> Option A

4. Quick Check:

   Roles need ROLE_ prefix [OK]

Hint: Always prefix roles with ROLE_ inside @Secured [OK]

Common Mistakes:

• Omitting ROLE_ prefix
• Using dash (-) instead of underscore (_)
• Using wrong role names

3.

Given this method secured with @Secured({"ROLE_USER", "ROLE_ADMIN"}), what happens if a user with role ROLE_GUEST calls it?

@Secured({"ROLE_USER", "ROLE_ADMIN"})
public String getData() {
    return "Secret Data";
}

medium

A. The method executes and returns "Secret Data"

B. The method executes but returns empty string

C. The method returns null

D. Access denied error is thrown

Solution

1. Step 1: Understand role checking with @Secured

   The annotation allows only users with roles ROLE_USER or ROLE_ADMIN.

2. Step 2: Check user role

   User has ROLE_GUEST, which is not allowed, so access is denied.

3. Final Answer:

   Access denied error is thrown -> Option D

4. Quick Check:

   User role mismatch causes denial [OK]

Hint: Only listed roles can access; others get denied [OK]

Common Mistakes:

• Assuming method runs for any role
• Thinking method returns null on denial
• Confusing role names

4.

Identify the error in this usage of @Secured:

@Secured("ROLE_ADMIN")
public void adminTask() { }

medium

A. Role name should not have ROLE_ prefix

B. Missing curly braces around roles array

C. Method must return a value

D. Annotation should be @RolesAllowed instead

Solution

1. Step 1: Check @Secured syntax

   @Secured expects an array of roles, so roles must be inside curly braces {}.

2. Step 2: Analyze given code

   Here, roles are given as a single string without braces, causing syntax error.

3. Final Answer:

   Missing curly braces around roles array -> Option B

4. Quick Check:

   @Secured requires roles in braces [OK]

Hint: Always use braces {} for roles in @Secured [OK]

Common Mistakes:

• Omitting braces for single role
• Removing ROLE_ prefix
• Confusing @Secured with @RolesAllowed

5.

You want to secure two methods: one accessible only by ROLE_ADMIN, and another accessible by either ROLE_USER or ROLE_MANAGER. Which is the correct way to annotate these methods?

Method 1:
@Secured({"?"})
public void adminOnly() { }

Method 2:
@Secured({"?"})
public void userOrManager() { }

hard

A. {"ROLE_ADMIN"} and {"ROLE_USER|ROLE_MANAGER"}

B. {"ADMIN"} and {"USER", "MANAGER"}

C. {"ROLE_ADMIN"} and {"ROLE_USER", "ROLE_MANAGER"}

D. {"ROLE_ADMIN", "ROLE_USER"} and {"ROLE_MANAGER"}

Solution

1. Step 1: Secure Method 1 for ROLE_ADMIN only

   Use @Secured({"ROLE_ADMIN"}) to restrict access to admins.

2. Step 2: Secure Method 2 for ROLE_USER or ROLE_MANAGER

   Use @Secured({"ROLE_USER", "ROLE_MANAGER"}) to allow either role.

3. Final Answer:

   {"ROLE_ADMIN"} and {"ROLE_USER", "ROLE_MANAGER"} -> Option C

4. Quick Check:

   Use arrays with ROLE_ prefix for multiple roles [OK]

Hint: Use arrays with ROLE_ prefix for each method [OK]

Common Mistakes:

• Omitting ROLE_ prefix
• Using pipe '|' inside role strings
• Mixing roles in one annotation incorrectly