Securing endpoints by role in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the role required to access the endpoint.

Spring Boot

@PreAuthorize("hasRole('[1]')")
@GetMapping("/admin")
public String adminEndpoint() {
    return "Admin content";
}

Drag options to blanks, or click blank then click option'

AGUEST

BMANAGER

CUSER

DADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Using lowercase role names like 'admin' instead of uppercase 'ADMIN'.

Forgetting to use the @PreAuthorize annotation.

The @PreAuthorize annotation checks if the user has the specified role. Here, ADMIN is the required role to access this endpoint.

2fill in blank

medium

Complete the code to secure the endpoint so only users with the 'USER' role can access it.

Spring Boot

@PreAuthorize("hasRole('[1]')")
@GetMapping("/profile")
public String userProfile() {
    return "User profile content";
}

Drag options to blanks, or click blank then click option'

AMODERATOR

BADMIN

CUSER

DGUEST

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'USER'.

Using a role that does not exist in the system.

The @PreAuthorize annotation restricts access to users with the USER role for this endpoint.

3fill in blank

hard

Fix the error in the annotation to correctly check if the user has the 'MANAGER' role.

Spring Boot

@PreAuthorize("hasRole([1])")
@GetMapping("/manage")
public String manageEndpoint() {
    return "Manager content";
}

Drag options to blanks, or click blank then click option'

A"MANAGER"

BMANAGER

C'MANAGER'

Dmanager

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the role name.

Using single quotes inside double quotes without escaping.

The hasRole function expects the role name as a string literal inside quotes. Using double quotes inside the annotation string is correct here.

4fill in blank

hard

Fill both blanks to secure the endpoint so only users with 'ADMIN' or 'MODERATOR' roles can access it.

Spring Boot

@PreAuthorize("hasRole('[1]') or hasRole('[2]')")
@GetMapping("/dashboard")
public String dashboard() {
    return "Dashboard content";
}

Drag options to blanks, or click blank then click option'

AADMIN

BUSER

CMODERATOR

DGUEST

Attempts:

3 left

💡 Hint

Common Mistakes

Using roles not allowed to access the endpoint.

Forgetting to use 'or' between role checks.

The @PreAuthorize annotation uses or to allow access if the user has either the ADMIN or MODERATOR role.

5fill in blank

hard

Fill all three blanks to secure the endpoint so only users with 'ADMIN' role and 'ACTIVE' status can access it using SpEL expressions.

Spring Boot

@PreAuthorize("hasRole('[1]') and @userService.isActiveUser(authentication.name) == [2] and principal.enabled == [3]")
@GetMapping("/secure-data")
public String secureData() {
    return "Secure data content";
}

Drag options to blanks, or click blank then click option'

AUSER

Btrue

DADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'True' or 'FALSE' instead of lowercase booleans.

Using the wrong role name.

The @PreAuthorize annotation checks that the user has the ADMIN role, the user is active via a service method returning true, and the principal's enabled flag is true.