SecurityFilterChain configuration in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of this SecurityFilterChain configuration?

Consider this Spring Boot SecurityFilterChain bean configuration. What will be the behavior when a user tries to access the "/admin" endpoint without authentication?

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/admin").authenticated()
            .anyRequest().permitAll()
        )
        .formLogin();
    return http.build();
}

A The user is redirected to the home page automatically.

B The user can access "/admin" without login.

C The user is redirected to a login page before accessing "/admin".

D The user receives a 403 Forbidden error immediately.

💡 Hint

Think about what .authenticated() means and what formLogin() does.

The configuration requires authentication for "/admin" and enables form login. So unauthenticated users are redirected to the login page.

📝 Syntax

intermediate

Identify the syntax error in this SecurityFilterChain configuration

Which option correctly fixes the syntax error in this Spring SecurityFilterChain configuration snippet?

Spring Boot

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/user").hasRole("USER")
    .anyRequest().authenticated()
  )
  .formLogin()
  .and()
  .csrf().disable();

A Remove .and() and chain .csrf().disable() directly after .formLogin().

B Replace .and() with another .authorizeHttpRequests() call.

C Add a semicolon after .formLogin() to separate method calls.

D Change .requestMatchers() to .antMatchers() to fix syntax.

💡 Hint

Check how method chaining works in HttpSecurity configuration.

In the new lambda style, .and() is not needed; chaining .csrf().disable() directly after .formLogin() is correct.

❓ state_output

advanced

What is the value of 'isCsrfEnabled' after this configuration?

Given this SecurityFilterChain configuration, what is the value of the boolean variable 'isCsrfEnabled' after the filter chain is built?

Spring Boot

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

boolean isCsrfEnabled;

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf.disable())
        .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
    isCsrfEnabled = http.getConfigurer(org.springframework.security.config.annotation.web.configurers.CsrfConfigurer.class) != null;
    return http.build();
}

A Throws a NullPointerException

B null

C true

D false

💡 Hint

Disabling CSRF removes its configurer from HttpSecurity.

Calling csrf.disable() disables CSRF protection and removes its configurer, so getConfigurer returns null, making isCsrfEnabled false.

🔧 Debug

advanced

Why does this SecurityFilterChain configuration cause a runtime error?

This SecurityFilterChain configuration throws an exception at runtime. What is the cause?

Spring Boot

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/**").hasAuthority("ADMIN")
    .anyRequest().authenticated()
  )
  .httpBasic()
  .csrf(csrf -> csrf.disable())
  .build();

A The order of .httpBasic() and .csrf() calls is invalid and causes a runtime error.

B Calling .build() directly on HttpSecurity causes an error; it should be returned from a bean method.

C Missing @Bean annotation on the method returning SecurityFilterChain causes the error.

D Using .requestMatchers() with a pattern requires enabling WebSecurityCustomizer first.

💡 Hint

Check how SecurityFilterChain beans are created and returned.

Calling .build() on HttpSecurity outside a @Bean method or without returning it causes runtime errors because Spring Security expects a bean of type SecurityFilterChain.

🧠 Conceptual

expert

Which option best describes the role of SecurityFilterChain in Spring Security?

Select the most accurate description of what a SecurityFilterChain does in a Spring Boot application.

A It defines a sequence of security filters that process HTTP requests to enforce authentication and authorization rules.

B It is a database connection pool that manages user credentials securely.

C It is a UI component that displays login forms and error messages.

D It is a configuration class that replaces the entire Spring Security framework.

💡 Hint

Think about what filters do in web security.

SecurityFilterChain is a chain of filters that intercept HTTP requests to apply security checks like authentication and authorization.