Securing endpoints by role in Spring Boot - Mini Project: Build & Apply

Securing endpoints by role

📖 Scenario: You are building a simple Spring Boot web application that has two types of users: ADMIN and USER. You want to protect your web endpoints so that only users with the right roles can access certain pages.For example, the /admin page should only be accessible by users with the ADMIN role, while the /user page should be accessible by users with the USER role.

🎯 Goal: Build a Spring Boot security configuration that restricts access to endpoints based on user roles.You will create a simple in-memory user store, define roles, and secure the endpoints accordingly.

📋 What You'll Learn

Create an in-memory user store with two users: one with role ADMIN and one with role USER

Define a security configuration class to secure endpoints

Restrict access to /admin endpoint to only ADMIN role

Restrict access to /user endpoint to only USER role

💡 Why This Matters

🌍 Real World

Securing web application endpoints by user roles is common in real-world apps to protect sensitive pages and data.

💼 Career

Understanding how to configure Spring Security for role-based access control is a key skill for backend Java developers working on secure web applications.

1

Create in-memory users with roles

Create a Spring Security configuration class called SecurityConfig. Inside it, create a userDetailsService bean that defines two users: admin with password adminpass and role ADMIN, and user with password userpass and role USER. Use InMemoryUserDetailsManager and User.withDefaultPasswordEncoder() to create users.

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
public class SecurityConfig {
    
    // Your code here
}

Hint

Use User.withDefaultPasswordEncoder() to create users with roles and passwords. Then return an InMemoryUserDetailsManager with these users.

2

Add HTTP security configuration

In the SecurityConfig class, add a SecurityFilterChain bean method called filterChain that takes HttpSecurity http as a parameter. For now, configure it to allow all requests without authentication by calling http.authorizeHttpRequests().anyRequest().permitAll() and then http.build().

Spring Boot

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {
    @Bean
    public UserDetailsService userDetailsService() {
        var userAdmin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("adminpass")
            .roles("ADMIN")
            .build();
        var userUser = User.withDefaultPasswordEncoder()
            .username("user")
            .password("userpass")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(userAdmin, userUser);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // Your code here
    }
}

Hint

Use http.authorizeHttpRequests().anyRequest().permitAll() to allow all requests for now. Return http.build() at the end.

3

Restrict access to /admin and /user endpoints by role

Modify the filterChain method to restrict access: allow only users with role ADMIN to access /admin endpoint, and only users with role USER to access /user endpoint. Use http.authorizeHttpRequests() with requestMatchers and hasRole methods. Also require authentication for any other requests.

Spring Boot

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // Your code here
    }

Hint

Use requestMatchers("/admin").hasRole("ADMIN") and requestMatchers("/user").hasRole("USER") to restrict access. Then require authentication for other requests.

4

Enable form login for authentication

In the filterChain method, add form login support by calling http.formLogin() before returning http.build(). This will enable a simple login page for users to authenticate.

Spring Boot

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests()
            .requestMatchers("/admin").hasRole("ADMIN")
            .requestMatchers("/user").hasRole("USER")
            .anyRequest().authenticated();
        // Your code here
    }

Hint

Add http.formLogin() to enable a default login form for authentication.

Practice

1. What is the primary purpose of using @PreAuthorize in a Spring Boot application?

easy

A. To log user activities

B. To format the response data

C. To handle database transactions

D. To restrict access to methods based on user roles

Solution

1. Step 1: Understand the role of @PreAuthorize

   @PreAuthorize is an annotation used to secure methods by specifying access rules based on user roles or permissions.

2. Step 2: Identify its main function

   It restricts method access so only users with certain roles can execute them, enhancing security.

3. Final Answer:

   To restrict access to methods based on user roles -> Option D

4. Quick Check:

   @PreAuthorize controls access by roles [OK]

Hint: Remember @PreAuthorize controls method access by roles [OK]

Common Mistakes:

• Confusing @PreAuthorize with logging or formatting annotations
• Thinking it manages database transactions
• Assuming it handles response data formatting

2. Which of the following is the correct syntax to restrict access to a method only to users with the role 'ADMIN' using @PreAuthorize?

easy

A. @PreAuthorize("hasRole('ADMIN')")

B. @PreAuthorize("hasRole('USER')")

C. @PreAuthorize("permitAll()")

D. @PreAuthorize("denyAll()")

Solution

1. Step 1: Understand the hasRole syntax

   The hasRole('ROLE_NAME') expression inside @PreAuthorize restricts access to users with that role.

2. Step 2: Match the role 'ADMIN'

   To restrict to 'ADMIN', use hasRole('ADMIN'). Other options either allow all or restrict to different roles.

3. Final Answer:

   @PreAuthorize("hasRole('ADMIN')") -> Option A

4. Quick Check:

   Correct role syntax = @PreAuthorize("hasRole('ADMIN')") [OK]

Hint: Use hasRole('ROLE_NAME') exactly for role checks [OK]

Common Mistakes:

• Using wrong role names like 'USER' instead of 'ADMIN'
• Using permitAll or denyAll when restricting by role
• Incorrect syntax like missing quotes

3. Given the following method in a Spring Boot controller:

@PreAuthorize("hasRole('MANAGER')")
public String getManagerData() {
    return "Manager Info";
}

What will happen if a user with role 'EMPLOYEE' tries to access getManagerData()?

medium

A. Access is denied and an error is thrown

B. The method returns "Manager Info"

C. The method returns null

D. The method executes but returns an empty string

Solution

1. Step 1: Check the role restriction

   The method is restricted to users with role 'MANAGER' only.

2. Step 2: Analyze access for 'EMPLOYEE' role

   A user with role 'EMPLOYEE' does not meet the role requirement, so access is denied by Spring Security.

3. Final Answer:

   Access is denied and an error is thrown -> Option A

4. Quick Check:

   Role mismatch causes access denial [OK]

Hint: Access denied if user role doesn't match @PreAuthorize role [OK]

Common Mistakes:

• Assuming method returns data regardless of role
• Thinking method returns null or empty string on denial
• Ignoring Spring Security's access control

4. Consider this Spring Boot method:

@PreAuthorize("hasRole('ADMIN')")
public String adminPanel() {
    return "Welcome Admin";
}

Which of the following is a common mistake that will cause this security annotation to fail?

medium

A. Returning a String instead of void

B. Using hasRole('admin') with lowercase role name

C. Placing @PreAuthorize above the method

D. Not importing org.springframework.security.access.prepost.PreAuthorize

Solution

1. Step 1: Check role name case sensitivity

   Spring Security roles are case sensitive. Using lowercase 'admin' instead of 'ADMIN' causes the check to fail.

2. Step 2: Verify other options

   @PreAuthorize must be above the method, returning String is valid, and missing import causes compile error but not security failure.

3. Final Answer:

   Using hasRole('admin') with lowercase role name -> Option B

4. Quick Check:

   Role names are case sensitive [OK]

Hint: Role names must match case exactly in hasRole() [OK]

Common Mistakes:

• Using lowercase role names
• Ignoring import statements causing compile errors
• Misplacing @PreAuthorize annotation

5. You want to secure two endpoints in your Spring Boot app: one accessible only by users with role 'USER', and another accessible only by users with role 'ADMIN'. Which is the best way to implement this using @PreAuthorize?

hard

A. Use @PreAuthorize("hasRole('USER') or hasRole('ADMIN')") on both methods

B. Use @PreAuthorize("hasAnyRole('USER', 'ADMIN')") on both methods

C. Use @PreAuthorize("hasRole('USER')") on the user method and @PreAuthorize("hasRole('ADMIN')") on the admin method

D. Use @PreAuthorize("permitAll()") on both methods and check roles inside method

Solution

1. Step 1: Understand role-specific access

   Each endpoint should restrict access to its specific role only, not both roles together.

2. Step 2: Apply correct @PreAuthorize annotations

   Use @PreAuthorize("hasRole('USER')") on the user endpoint and @PreAuthorize("hasRole('ADMIN')") on the admin endpoint to enforce separate access.

3. Final Answer:

   Use @PreAuthorize("hasRole('USER')") on the user method and @PreAuthorize("hasRole('ADMIN')") on the admin method -> Option C

4. Quick Check:

   Separate roles need separate @PreAuthorize rules [OK]

Hint: Assign each method its specific role in @PreAuthorize [OK]

Common Mistakes:

• Using combined roles on both methods allowing wrong access
• Using permitAll and checking roles manually inside methods
• Using hasAnyRole on both methods ignoring role separation