SecurityFilterChain configuration in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of this SecurityFilterChain configuration?

Consider this Spring Boot SecurityFilterChain bean configuration. What will be the behavior when a user tries to access the "/admin" endpoint without authentication?

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/admin").authenticated()
            .anyRequest().permitAll()
        )
        .formLogin();
    return http.build();
}

A The user is redirected to the home page automatically.

B The user can access "/admin" without login.

C The user is redirected to a login page before accessing "/admin".

D The user receives a 403 Forbidden error immediately.

💡 Hint

Think about what .authenticated() means and what formLogin() does.

The configuration requires authentication for "/admin" and enables form login. So unauthenticated users are redirected to the login page.

📝 Syntax

intermediate

Identify the syntax error in this SecurityFilterChain configuration

Which option correctly fixes the syntax error in this Spring SecurityFilterChain configuration snippet?

Spring Boot

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/user").hasRole("USER")
    .anyRequest().authenticated()
  )
  .formLogin()
  .and()
  .csrf().disable();

A Remove .and() and chain .csrf().disable() directly after .formLogin().

B Replace .and() with another .authorizeHttpRequests() call.

C Add a semicolon after .formLogin() to separate method calls.

D Change .requestMatchers() to .antMatchers() to fix syntax.

💡 Hint

Check how method chaining works in HttpSecurity configuration.

In the new lambda style, .and() is not needed; chaining .csrf().disable() directly after .formLogin() is correct.

❓ state_output

advanced

What is the value of 'isCsrfEnabled' after this configuration?

Given this SecurityFilterChain configuration, what is the value of the boolean variable 'isCsrfEnabled' after the filter chain is built?

Spring Boot

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

boolean isCsrfEnabled;

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf.disable())
        .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
    isCsrfEnabled = http.getConfigurer(org.springframework.security.config.annotation.web.configurers.CsrfConfigurer.class) != null;
    return http.build();
}

A Throws a NullPointerException

B null

C true

D false

💡 Hint

Disabling CSRF removes its configurer from HttpSecurity.

Calling csrf.disable() disables CSRF protection and removes its configurer, so getConfigurer returns null, making isCsrfEnabled false.

🔧 Debug

advanced

Why does this SecurityFilterChain configuration cause a runtime error?

This SecurityFilterChain configuration throws an exception at runtime. What is the cause?

Spring Boot

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/**").hasAuthority("ADMIN")
    .anyRequest().authenticated()
  )
  .httpBasic()
  .csrf(csrf -> csrf.disable())
  .build();

A The order of .httpBasic() and .csrf() calls is invalid and causes a runtime error.

B Calling .build() directly on HttpSecurity causes an error; it should be returned from a bean method.

C Missing @Bean annotation on the method returning SecurityFilterChain causes the error.

D Using .requestMatchers() with a pattern requires enabling WebSecurityCustomizer first.

💡 Hint

Check how SecurityFilterChain beans are created and returned.

Calling .build() on HttpSecurity outside a @Bean method or without returning it causes runtime errors because Spring Security expects a bean of type SecurityFilterChain.

🧠 Conceptual

expert

Which option best describes the role of SecurityFilterChain in Spring Security?

Select the most accurate description of what a SecurityFilterChain does in a Spring Boot application.

A It defines a sequence of security filters that process HTTP requests to enforce authentication and authorization rules.

B It is a database connection pool that manages user credentials securely.

C It is a UI component that displays login forms and error messages.

D It is a configuration class that replaces the entire Spring Security framework.

💡 Hint

Think about what filters do in web security.

SecurityFilterChain is a chain of filters that intercept HTTP requests to apply security checks like authentication and authorization.

Practice

1. What is the primary purpose of a SecurityFilterChain in Spring Boot?

easy

A. To handle file uploads

B. To define security rules for web requests and control access

C. To manage application logging levels

D. To configure database connections

Solution

1. Step 1: Understand the role of SecurityFilterChain

   The SecurityFilterChain is used in Spring Security to define how HTTP requests are secured, including which URLs require authentication and what roles can access them.

2. Step 2: Compare with other options

   Database connections, logging, and file uploads are unrelated to SecurityFilterChain's purpose.

3. Final Answer:

   To define security rules for web requests and control access -> Option B

4. Quick Check:

   SecurityFilterChain controls web security = D [OK]

Hint: SecurityFilterChain controls web request security rules [OK]

Common Mistakes:

• Confusing SecurityFilterChain with database or logging config
• Thinking it manages file uploads
• Assuming it handles application-wide settings

2. Which of the following is the correct way to declare a SecurityFilterChain bean in Spring Boot?

easy

A. @Component public void filterChain(HttpSecurity http) { http.build(); }

B. public SecurityFilterChain filterChain() { return new SecurityFilterChain(); }

C. @Bean public void filterChain() { return http.build(); }

D. @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http.build(); }

Solution

1. Step 1: Identify correct bean declaration syntax

   In Spring Boot, a SecurityFilterChain bean must be annotated with @Bean, accept HttpSecurity as a parameter, and return the built chain with http.build().

2. Step 2: Check each option

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http.build(); } correctly uses @Bean, returns SecurityFilterChain, and calls http.build(). Options B and D have wrong return types or missing annotations. @Component public void filterChain(HttpSecurity http) { http.build(); } uses @Component and void return, which is incorrect.

3. Final Answer:

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http.build(); } -> Option D

4. Quick Check:

   Correct bean method signature = C [OK]

Hint: Bean method must return SecurityFilterChain and use @Bean [OK]

Common Mistakes:

• Forgetting @Bean annotation
• Using void return type
• Not passing HttpSecurity parameter

3. Given this SecurityFilterChain configuration snippet, what will happen when a user accesses /admin URL?

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin").hasRole("ADMIN")
    .anyRequest().authenticated()
  ).formLogin();
  return http.build();
}

medium

A. All URLs are open without authentication

B. Anyone can access /admin without login

C. Only users with role ADMIN can access /admin; others must log in

D. Access to /admin is denied to everyone

Solution

1. Step 1: Analyze the authorization rules

   The config states that requests to "/admin" require the user to have role "ADMIN". All other requests require authentication but no specific role.

2. Step 2: Understand formLogin and access control

   Form login is enabled, so users must log in. Only users with ADMIN role can access /admin; others will be blocked or redirected to login.

3. Final Answer:

   Only users with role ADMIN can access /admin; others must log in -> Option C

4. Quick Check:

   /admin requires ADMIN role = A [OK]

Hint: Check requestMatchers roles and formLogin presence [OK]

Common Mistakes:

• Assuming /admin is open to all
• Ignoring role restrictions
• Thinking formLogin disables security

4. Identify the error in this SecurityFilterChain configuration:

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
  http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/user").authenticated()
    .anyRequest().permitAll()
  );
  return http.build();
}

medium

A. Missing throws Exception in method signature

B. Calling http.build() without returning it

C. No error, configuration is correct

D. Using permitAll() before authenticated() causes error

Solution

1. Step 1: Check method signature for exceptions

   The http.build() method can throw a checked exception, so the method should declare throws Exception.

2. Step 2: Verify return statement and method correctness

   The method returns http.build() correctly. The order of authenticated() and permitAll() is valid. So the only issue is missing exception declaration.

3. Final Answer:

   Missing throws Exception in method signature -> Option A

4. Quick Check:

   http.build() may throw Exception = B [OK]

Hint: Add throws Exception when calling http.build() [OK]

Common Mistakes:

• Omitting throws Exception causes compile error
• Misunderstanding order of permitAll and authenticated
• Forgetting to return http.build()

5. You want to configure a SecurityFilterChain that allows anonymous access to /public/**, requires authentication for /user/**, and restricts /admin/** to users with role ADMIN, and denies access to all other requests. Which configuration snippet correctly implements this?

hard

A. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").permitAll()
.requestMatchers("/user/**").authenticated()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().denyAll()
).formLogin();
return http.build();
}

B. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/admin/**").hasRole("ADMIN")
.requestMatchers("/user/**").authenticated()
.requestMatchers("/public/**").permitAll()
.anyRequest().authenticated()
).formLogin();
return http.build();
}

C. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").authenticated()
.requestMatchers("/user/**").permitAll()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().denyAll()
).formLogin();
return http.build();
}

D. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").permitAll()
.requestMatchers("/user/**").permitAll()
.requestMatchers("/admin/**").authenticated()
.anyRequest().denyAll()
).formLogin();
return http.build();
}

Solution

1. Step 1: Match access rules to URL patterns

   The requirement is: /public/** open to all (permitAll), /user/** requires authentication, /admin/** requires ADMIN role, and all others denied.

2. Step 2: Check each option's order and rules

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").permitAll() .requestMatchers("/user/**").authenticated() .requestMatchers("/admin/**").hasRole("ADMIN") .anyRequest().denyAll() ).formLogin(); return http.build(); } matches the requirements exactly. @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/user/**").authenticated() .requestMatchers("/public/**").permitAll() .anyRequest().authenticated() ).formLogin(); return http.build(); } allows anyRequest authenticated (not denyAll). @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").authenticated() .requestMatchers("/user/**").permitAll() .requestMatchers("/admin/**").hasRole("ADMIN") .anyRequest().denyAll() ).formLogin(); return http.build(); } swaps permitAll and authenticated for /public and /user incorrectly. @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").permitAll() .requestMatchers("/user/**").permitAll() .requestMatchers("/admin/**").authenticated() .anyRequest().denyAll() ).formLogin(); return http.build(); } permits /user/** to all and only authenticates /admin/**, which is wrong.

3. Final Answer:

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").permitAll() .requestMatchers("/user/**").authenticated() .requestMatchers("/admin/**").hasRole("ADMIN") .anyRequest().denyAll() ).formLogin(); return http.build(); } -> Option A

4. Quick Check:

   Correct URL access rules = A [OK]

Hint: Match URL patterns to correct access methods in order [OK]

Common Mistakes:

• Mixing permitAll and authenticated for URLs
• Forgetting to restrict admin URLs by role
• Using anyRequest().authenticated() instead of denyAll()