Why Spring Security matters in Spring Boot - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable basic HTTP security in a Spring Boot application.

Spring Boot

http
  .authorizeHttpRequests()
  .anyRequest().[1]();

Drag options to blanks, or click blank then click option'

Aanonymous

BpermitAll

CdenyAll

Dauthenticated

Attempts:

3 left

💡 Hint

Common Mistakes

Using permitAll() which allows access without login

Using denyAll() which blocks all access

The authenticated() method ensures that all requests require the user to be logged in, which is a basic security measure.

2fill in blank

medium

Complete the code to configure a password encoder bean in Spring Security.

Spring Boot

@Bean
public PasswordEncoder passwordEncoder() {
    return new [1]();
}

Drag options to blanks, or click blank then click option'

AMD5PasswordEncoder

BBCryptPasswordEncoder

CPlainTextPasswordEncoder

DNoOpPasswordEncoder

Attempts:

3 left

💡 Hint

Common Mistakes

Using NoOpPasswordEncoder which stores passwords as plain text

Using MD5PasswordEncoder which is outdated and insecure

BCryptPasswordEncoder is the recommended password encoder because it hashes passwords securely.

3fill in blank

hard

Fix the error in the code to properly configure HTTP Basic authentication.

Spring Boot

http
  .httpBasic()
  .and()
  .authorizeHttpRequests()
  .anyRequest().[1]();

Drag options to blanks, or click blank then click option'

ApermitAll

BdenyAll

Cauthenticated

Danonymous

Attempts:

3 left

💡 Hint

Common Mistakes

Using permitAll() which disables authentication

Using denyAll() which blocks all access

Using authenticated() ensures that HTTP Basic authentication protects all requests.

4fill in blank

hard

Fill both blanks to create a security filter chain bean that disables CSRF and requires authentication for all requests.

Spring Boot

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.csrf().[1]();
    http.authorizeHttpRequests().anyRequest().[2]();
    return http.build();
}

Drag options to blanks, or click blank then click option'

Adisable

Bauthenticated

CpermitAll

Denable

Attempts:

3 left

💡 Hint

Common Mistakes

Using enable() instead of disable() for CSRF

Using permitAll() which allows access without login

Disabling CSRF is done with disable(). Requiring authentication uses authenticated().

5fill in blank

hard

Fill all three blanks to configure a custom login page URL, logout URL, and success URL after login.

Spring Boot

http
  .formLogin()
    .loginPage("[1]")
    .defaultSuccessUrl("[3]", true)
  .and()
  .logout()
    .logoutUrl("[2]");

Drag options to blanks, or click blank then click option'

A/custom-login

B/perform-logout

C/home

D/login

Attempts:

3 left

💡 Hint

Common Mistakes

Using default login page URL '/login' instead of custom

Not setting logout URL correctly

Not specifying a success URL after login

The custom login page is set to /custom-login, logout URL to /perform-logout, and after successful login, the user is redirected to /home.