Why authorization matters in Spring Boot - See It in Action

Why authorization matters

📖 Scenario: You are building a simple Spring Boot web application that has two types of users: regular users and admins. You want to make sure that only admins can access the admin page, while regular users can only access the user page.

🎯 Goal: Create a Spring Boot project that sets up basic authorization rules to protect the admin page so only users with the role ADMIN can access it, while users with the role USER can access the user page.

📋 What You'll Learn

Create a simple user data structure with usernames and roles

Add a configuration variable to define the admin role name

Implement authorization logic to restrict access based on roles

Complete the Spring Security configuration to enforce these rules

💡 Why This Matters

🌍 Real World

Authorization is essential in web apps to protect sensitive pages and data. This project shows how to restrict access based on user roles.

💼 Career

Understanding authorization is key for backend developers working with Spring Boot to build secure applications.

1

DATA SETUP: Create user roles map

Create a Map<String, String> called userRoles with these exact entries: "alice" : "USER", "bob" : "ADMIN", "carol" : "USER".

Spring Boot

// Create a Map called userRoles with exact entries
// Your code here

Hint

Use Map.of() to create a small map with usernames as keys and roles as values.

2

CONFIGURATION: Define admin role constant

Add a String variable called ADMIN_ROLE and set it to "ADMIN".

Spring Boot

Map userRoles = Map.of(
    "alice", "USER",
    "bob", "ADMIN",
    "carol", "USER"
);
// Define ADMIN_ROLE constant
// Your code here

Hint

Use a simple String variable to hold the admin role name for easy reuse.

3

CORE LOGIC: Check if user is admin

Write a method boolean isAdmin(String username) that returns true if the user's role in userRoles equals ADMIN_ROLE, otherwise false.

Spring Boot

Map userRoles = Map.of(
    "alice", "USER",
    "bob", "ADMIN",
    "carol", "USER"
);

String ADMIN_ROLE = "ADMIN";

// Write isAdmin method
// Your code here

Hint

Use userRoles.get(username) to get the role and compare it with ADMIN_ROLE.

4

COMPLETION: Configure Spring Security to restrict access

In your Spring Security configuration, add authorization rules so that /admin/** URLs require hasRole("ADMIN") and /user/** URLs require hasRole("USER").

Spring Boot

Map userRoles = Map.of(
    "alice", "USER",
    "bob", "ADMIN",
    "carol", "USER"
);

String ADMIN_ROLE = "ADMIN";

boolean isAdmin(String username) {
    return ADMIN_ROLE.equals(userRoles.get(username));
}

// Add Spring Security authorization rules
// Your code here

Hint

Use http.authorizeRequests() with antMatchers to set role-based access.

Practice

1. Why is authorization important in a Spring Boot application?

easy

A. It controls which users can access specific features or data.

B. It speeds up the application performance.

C. It automatically fixes bugs in the code.

D. It manages database connections.

Solution

1. Step 1: Understand the role of authorization

   Authorization decides what parts of the app a user can use or see.

2. Step 2: Compare with other options

   Speed, bug fixing, and database management are unrelated to authorization.

3. Final Answer:

   It controls which users can access specific features or data. -> Option A

4. Quick Check:

   Authorization = Access control [OK]

Hint: Authorization means controlling user access rights [OK]

Common Mistakes:

• Confusing authorization with authentication
• Thinking authorization improves speed
• Assuming it manages databases

2. Which of the following is the correct way to restrict access to a controller method in Spring Boot using annotations?

easy

A. @Component

B. @RequestMapping("/user")

C. @Autowired

D. @Secured("ROLE_USER")

Solution

1. Step 1: Identify the annotation for authorization

   @Secured is used to specify roles allowed to access a method.

2. Step 2: Understand other annotations

   @RequestMapping maps URLs, @Autowired injects dependencies, @Component marks beans.

3. Final Answer:

   @Secured("ROLE_USER") -> Option D

4. Quick Check:

   @Secured = Role-based access [OK]

Hint: Use @Secured to set role access on methods [OK]

Common Mistakes:

• Using @RequestMapping for authorization
• Confusing @Autowired with access control
• Mixing @Component with security

3. Given this Spring Security configuration snippet, what will happen if a user without the ADMIN role tries to access /admin/dashboard?

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated();
}

medium

A. The user will be redirected to the login page.

B. The user will get a 403 Forbidden error.

C. The user can access the page without restrictions.

D. The application will crash with an exception.

Solution

1. Step 1: Analyze the role restriction

   The config restricts URLs starting with /admin/ to users with ADMIN role only.

2. Step 2: Understand unauthorized access behavior

   Users without ADMIN role get a 403 Forbidden error, not redirected or crash.

3. Final Answer:

   The user will get a 403 Forbidden error. -> Option B

4. Quick Check:

   Unauthorized access = 403 error [OK]

Hint: No role match means 403 Forbidden error [OK]

Common Mistakes:

• Thinking unauthorized users get redirected automatically
• Assuming unrestricted access
• Expecting application crash on access denial

4. Identify the error in this Spring Security method-level authorization code:

@Secured("USER")
public String getUserData() {
    return "data";
}

medium

A. The role name should be prefixed with 'ROLE_'.

B. The method must return void for @Secured.

C. The annotation should be @Autowired instead of @Secured.

D. The method name cannot be getUserData.

Solution

1. Step 1: Check role naming convention

   Spring Security expects roles to be prefixed with 'ROLE_', so "USER" should be "ROLE_USER".

2. Step 2: Validate other options

   Return type can be String, @Autowired is unrelated, method name is valid.

3. Final Answer:

   The role name should be prefixed with 'ROLE_'. -> Option A

4. Quick Check:

   Role prefix 'ROLE_' required [OK]

Hint: Always prefix roles with 'ROLE_' in @Secured [OK]

Common Mistakes:

• Omitting 'ROLE_' prefix in role names
• Confusing @Secured with dependency injection
• Thinking method name affects authorization

5. You want to allow only users with roles ADMIN or MANAGER to access a sensitive endpoint in Spring Boot. Which configuration snippet correctly implements this authorization rule? A)

http.authorizeRequests()
    .antMatchers("/sensitive/**").hasAnyRole("ADMIN", "MANAGER")
    .anyRequest().authenticated();

B)

http.authorizeRequests()
    .antMatchers("/sensitive/**").hasRole("ADMIN")
    .antMatchers("/sensitive/**").hasRole("MANAGER")
    .anyRequest().authenticated();

C)

http.authorizeRequests()
    .antMatchers("/sensitive/**").permitAll()
    .anyRequest().authenticated();

D)

http.authorizeRequests()
    .antMatchers("/sensitive/**").denyAll()
    .anyRequest().authenticated();

hard

A. Permit all users to access the sensitive path.

B. Use two separate hasRole calls for each role on the same path.

C. Use hasAnyRole with both roles in one call.

D. Deny all users access to the sensitive path.

Solution

1. Step 1: Understand role checks for multiple roles

   hasAnyRole allows specifying multiple roles in one call to grant access if any match.

2. Step 2: Analyze other options

   Two separate hasRole calls on same path override each other, permitAll allows everyone, denyAll blocks all.

3. Final Answer:

   Use hasAnyRole with both roles in one call. -> Option C

4. Quick Check:

   Multiple roles = hasAnyRole() [OK]

Hint: Use hasAnyRole() for multiple roles on one path [OK]

Common Mistakes:

• Using multiple hasRole calls on same path
• Allowing all users mistakenly
• Denying all users when some should access