Why Spring Security matters in Spring Boot - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use Spring Security in a web application?

Which of the following best explains why Spring Security is important in a web application?

A It automatically generates user interfaces for all pages without coding.

B It provides a framework to handle authentication and authorization securely.

C It speeds up database queries by caching results.

D It manages the deployment of the application to cloud servers.

💡 Hint

Think about what security means for users accessing a web app.

Spring Security helps protect applications by managing who can access what, ensuring only authorized users get in.

❓ component_behavior

intermediate

What happens when Spring Security is added to a Spring Boot app?

When you add Spring Security to a Spring Boot application without any extra configuration, what is the default behavior?

A Only POST requests require authentication, GET requests are open.

B The application crashes due to missing security settings.

C All HTTP requests are allowed without restrictions.

D All HTTP requests require authentication with a generated default user and password.

💡 Hint

Think about what Spring Security does out of the box to protect your app.

By default, Spring Security locks down all endpoints and creates a default user with a generated password to require login.

❓ state_output

advanced

Spring Security filter chain behavior

Consider this Spring Security filter chain setup:

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/public/**").permitAll()
    .anyRequest().authenticated())
  .formLogin(withDefaults());

What happens when an unauthenticated user tries to access /public/info and /private/data?

A /public/info is accessible without login; /private/data requires login.

B Both URLs require login before access.

C /public/info redirects to login; /private/data is accessible without login.

D Both URLs are accessible without login.

💡 Hint

Look at which paths are allowed without authentication.

The configuration permits all requests under /public/** without login, but requires authentication for any other request.

📝 Syntax

advanced

Identify the correct Spring Security configuration snippet

Which of the following code snippets correctly configures Spring Security to disable CSRF protection and allow all requests to /api/** without authentication?

A

http.csrf().disable()
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/**").permitAll()
    .anyRequest().authenticated());

B

http.csrf().enable()
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/**").permitAll()
    .anyRequest().authenticated());

C

http.csrf().disable()
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/**").authenticated()
    .anyRequest().permitAll());

D

http.csrf().disable()
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/**").denyAll()
    .anyRequest().authenticated());

💡 Hint

Check the method to disable CSRF and the correct order of authorization rules.

Option A disables CSRF correctly and permits all requests to /api/** while requiring authentication for others.

🔧 Debug

expert

Why does this Spring Security configuration cause a runtime error?

Given this Spring Security configuration method:

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http
    .authorizeHttpRequests(auth -> auth
      .requestMatchers("/admin/**").hasRole("ADMIN")
      .anyRequest().authenticated())
    .formLogin();
  return http.build();
}

When running the app, it throws an error: java.lang.IllegalArgumentException: Role prefix 'ROLE_' is missing. What is the cause?

A The requestMatchers() method requires a list of URLs, not a string.

B The SecurityFilterChain bean must be named 'securityFilterChain' exactly.

C The role name should be prefixed with 'ROLE_' in hasRole method argument.

D The formLogin() method must be called before authorizeHttpRequests().

💡 Hint

Think about how Spring Security expects role names internally.

Spring Security expects roles to have a 'ROLE_' prefix internally. The hasRole("ADMIN") method automatically adds this prefix, so the actual role must be stored as 'ROLE_ADMIN'. If the prefix is missing in the stored roles, this error occurs.