Securing endpoints by role in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of securing endpoints by role in Spring Boot?

It restricts access to certain parts of an application based on the user's assigned roles, ensuring only authorized users can perform specific actions.

beginner

Which annotation is commonly used in Spring Boot to specify role-based access on methods or endpoints?

The @PreAuthorize annotation is used to define role-based access rules on methods or endpoints.

intermediate

How do you configure role-based access for HTTP endpoints in Spring Security?

You configure it in the SecurityFilterChain bean using authorizeHttpRequests() with matchers and hasRole() or hasAuthority() methods.

intermediate

What is the difference between hasRole('ADMIN') and hasAuthority('ROLE_ADMIN') in Spring Security?

hasRole('ADMIN') automatically adds the prefix ROLE_, so it checks for ROLE_ADMIN. hasAuthority('ROLE_ADMIN') checks the exact authority string without adding a prefix.

beginner

Why is it important to use role-based security instead of just authentication?

Authentication confirms who the user is, but role-based security controls what the user is allowed to do, protecting sensitive actions and data.

Which Spring Security annotation restricts access to a method based on user roles?

A @RequestMapping

B @Autowired

C @PreAuthorize

D @Component

@PreAuthorize is used to specify role-based access control on methods.

In Spring Security, what prefix does hasRole('USER') automatically add when checking authorities?

A ROLE-

B ROLE_

C AUTH_

D USER_

hasRole adds the prefix ROLE_ automatically.

Where do you typically configure HTTP endpoint security rules in Spring Boot?

A In a SecurityFilterChain bean

B In the main application class

C In the Controller class

D In the application.properties file

HTTP security rules are configured in a SecurityFilterChain bean.

What happens if a user without the required role tries to access a secured endpoint?

A Access is granted anyway

B User is redirected to the homepage

C User is automatically logged out

D Access is denied with a 403 Forbidden response

Spring Security returns a 403 Forbidden error when access is denied.

Which method is used to specify role requirements for HTTP requests in Spring Security?

A authorizeHttpRequests()

B configureHttp()

C setRoles()

D enableSecurity()

authorizeHttpRequests() is used to define access rules for HTTP endpoints.

Explain how to secure a REST endpoint in Spring Boot so only users with the ADMIN role can access it.

Think about configuring HTTP security with role checks.

Describe the difference between authentication and role-based authorization in Spring Security.

Consider what each step confirms about the user.