Why authorization matters in Spring Boot - Visual Breakdown

Concept Flow - Why authorization matters

User sends request

↓

Authentication: Who are you?

↓

Authorization: What can you do?

Yes No↓

Allow access

↓

Resource accessed or blocked

This flow shows how a user request is first checked for identity (authentication), then checked for permissions (authorization) before access is granted or denied.

Execution Sample

Spring Boot

httpSecurity.authorizeHttpRequests()
  .requestMatchers("/admin/**").hasRole("ADMIN")
  .anyRequest().authenticated();

This code configures Spring Security to allow only users with ADMIN role to access /admin paths, and requires authentication for all other requests.

Execution Table

Step	Request URL	User Role	Authorization Check	Access Result
1	/admin/dashboard	ADMIN	User has ADMIN role? Yes	Access granted
2	/admin/settings	USER	User has ADMIN role? No	Access denied
3	/profile	USER	Authenticated? Yes	Access granted
4	/profile	Anonymous	Authenticated? No	Access denied

💡 Access is granted only if authorization rules match user roles and authentication status.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
Request URL	none	/admin/dashboard	/admin/settings	/profile	/profile
User Role	none	ADMIN	USER	USER	Anonymous
Authorization Result	none	granted	denied	granted	denied

Key Moments - 2 Insights

Why does a user with role USER get denied access to /admin/settings?

Because the authorization rule requires ADMIN role for /admin/** paths, as shown in execution_table step 2.

Why is authentication checked before authorization?

Authorization depends on knowing who the user is, so authentication must happen first to identify the user, as shown in the concept_flow.

Visual Quiz - 3 Questions

Look at the execution_table, what is the access result for a USER role requesting /admin/settings?

A Access granted

B Request redirected

C Access denied

D Access pending

💡 Hint

Check execution_table row 2 under Access Result column.

At which step does an anonymous user get denied access?

A Step 2

B Step 4

C Step 3

D Step 1

💡 Hint

Look at execution_table row 4 for User Role and Access Result.

If the authorization rule for /admin/** was removed, what would happen to step 2's access result?

A Access granted to USER

B Access denied to USER

C Access denied to ADMIN

D Request blocked for all

💡 Hint

Without role check, only authentication is required as per code in execution_sample.

Concept Snapshot

Authorization controls what a user can do after authentication.
In Spring Boot, use httpSecurity.authorizeHttpRequests() to set rules.
Example: .requestMatchers("/admin/**").hasRole("ADMIN") restricts admin paths.
Requests failing authorization are denied access.
Always check authentication first, then authorization.

Full Transcript

Authorization is the process that decides what a user can access or do after they have logged in. In Spring Boot, authorization rules are set using httpSecurity.authorizeHttpRequests(), where you specify which roles can access certain URL patterns. For example, only users with the ADMIN role can access URLs starting with /admin/. The flow starts with a user sending a request, then authentication checks who the user is, followed by authorization checking what the user is allowed to do. If the user meets the authorization rules, access is granted; otherwise, it is denied. This ensures that sensitive parts of an application are protected from unauthorized users.

Practice

1. Why is authorization important in a Spring Boot application?

easy

A. It controls which users can access specific features or data.

B. It speeds up the application performance.

C. It automatically fixes bugs in the code.

D. It manages database connections.

Solution

1. Step 1: Understand the role of authorization

   Authorization decides what parts of the app a user can use or see.

2. Step 2: Compare with other options

   Speed, bug fixing, and database management are unrelated to authorization.

3. Final Answer:

   It controls which users can access specific features or data. -> Option A

4. Quick Check:

   Authorization = Access control [OK]

Hint: Authorization means controlling user access rights [OK]

Common Mistakes:

• Confusing authorization with authentication
• Thinking authorization improves speed
• Assuming it manages databases

2. Which of the following is the correct way to restrict access to a controller method in Spring Boot using annotations?

easy

A. @Component

B. @RequestMapping("/user")

C. @Autowired

D. @Secured("ROLE_USER")

Solution

1. Step 1: Identify the annotation for authorization

   @Secured is used to specify roles allowed to access a method.

2. Step 2: Understand other annotations

   @RequestMapping maps URLs, @Autowired injects dependencies, @Component marks beans.

3. Final Answer:

   @Secured("ROLE_USER") -> Option D

4. Quick Check:

   @Secured = Role-based access [OK]

Hint: Use @Secured to set role access on methods [OK]

Common Mistakes:

• Using @RequestMapping for authorization
• Confusing @Autowired with access control
• Mixing @Component with security

3. Given this Spring Security configuration snippet, what will happen if a user without the ADMIN role tries to access /admin/dashboard?

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated();
}

medium

A. The user will be redirected to the login page.

B. The user will get a 403 Forbidden error.

C. The user can access the page without restrictions.

D. The application will crash with an exception.

Solution

1. Step 1: Analyze the role restriction

   The config restricts URLs starting with /admin/ to users with ADMIN role only.

2. Step 2: Understand unauthorized access behavior

   Users without ADMIN role get a 403 Forbidden error, not redirected or crash.

3. Final Answer:

   The user will get a 403 Forbidden error. -> Option B

4. Quick Check:

   Unauthorized access = 403 error [OK]

Hint: No role match means 403 Forbidden error [OK]

Common Mistakes:

• Thinking unauthorized users get redirected automatically
• Assuming unrestricted access
• Expecting application crash on access denial

4. Identify the error in this Spring Security method-level authorization code:

@Secured("USER")
public String getUserData() {
    return "data";
}

medium

A. The role name should be prefixed with 'ROLE_'.

B. The method must return void for @Secured.

C. The annotation should be @Autowired instead of @Secured.

D. The method name cannot be getUserData.

Solution

1. Step 1: Check role naming convention

   Spring Security expects roles to be prefixed with 'ROLE_', so "USER" should be "ROLE_USER".

2. Step 2: Validate other options

   Return type can be String, @Autowired is unrelated, method name is valid.

3. Final Answer:

   The role name should be prefixed with 'ROLE_'. -> Option A

4. Quick Check:

   Role prefix 'ROLE_' required [OK]

Hint: Always prefix roles with 'ROLE_' in @Secured [OK]

Common Mistakes:

• Omitting 'ROLE_' prefix in role names
• Confusing @Secured with dependency injection
• Thinking method name affects authorization

5. You want to allow only users with roles ADMIN or MANAGER to access a sensitive endpoint in Spring Boot. Which configuration snippet correctly implements this authorization rule? A)

http.authorizeRequests()
    .antMatchers("/sensitive/**").hasAnyRole("ADMIN", "MANAGER")
    .anyRequest().authenticated();

B)

http.authorizeRequests()
    .antMatchers("/sensitive/**").hasRole("ADMIN")
    .antMatchers("/sensitive/**").hasRole("MANAGER")
    .anyRequest().authenticated();

C)

http.authorizeRequests()
    .antMatchers("/sensitive/**").permitAll()
    .anyRequest().authenticated();

D)

http.authorizeRequests()
    .antMatchers("/sensitive/**").denyAll()
    .anyRequest().authenticated();

hard

A. Permit all users to access the sensitive path.

B. Use two separate hasRole calls for each role on the same path.

C. Use hasAnyRole with both roles in one call.

D. Deny all users access to the sensitive path.

Solution

1. Step 1: Understand role checks for multiple roles

   hasAnyRole allows specifying multiple roles in one call to grant access if any match.

2. Step 2: Analyze other options

   Two separate hasRole calls on same path override each other, permitAll allows everyone, denyAll blocks all.

3. Final Answer:

   Use hasAnyRole with both roles in one call. -> Option C

4. Quick Check:

   Multiple roles = hasAnyRole() [OK]

Hint: Use hasAnyRole() for multiple roles on one path [OK]

Common Mistakes:

• Using multiple hasRole calls on same path
• Allowing all users mistakenly
• Denying all users when some should access