# Advanced Authentication & Authorization (Spring Boot)

> Advanced authentication, fine-grained authorization with @PreAuthorize/@PostAuthorize, roles, permissions, SpEL

- 30 interview questions
- Senior
- [Interview Questions: Spring Boot](https://sharpskill.dev/en/technologies/spring-boot/interview-questions.md)

## 1. What is the main role of the UserDetailsService interface in Spring Security?

**Answer**

UserDetailsService is responsible for loading user information from the data source (database, LDAP, etc.) during authentication. Its loadUserByUsername() method returns a UserDetails object containing the username, password, roles and authorities. Spring Security then uses this information to validate credentials and build the SecurityContext.

## 2. Which annotation enables method-level security in Spring Security 6+?

**Answer**

@EnableMethodSecurity is the modern annotation in Spring Security 6+ that enables method-level security. It replaces the old @EnableGlobalMethodSecurity and enables @PreAuthorize, @PostAuthorize and @Secured by default. It uses AOP proxy-based configuration to intercept method calls and check authorizations.

## 3. When does the @PreAuthorize annotation check authorizations?

**Answer**

@PreAuthorize checks authorizations BEFORE method execution. If the SpEL condition returns false, an AccessDeniedException is thrown and the method is never executed. This prevents access to unauthorized resources from the start. In contrast, @PostAuthorize checks after execution, which is useful for filtering results based on the user.

## 27 more questions available

- What is the main difference between hasRole() and hasAuthority() in Spring Security?
- How to implement a custom UserDetailsService that loads users from a database?

Sign up for free: https://sharpskill.dev/en/login

## Other Spring Boot interview topics

- [Spring Core - IoC & DI](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-core-ioc-di.md): 22 questions, Junior
- [Spring Boot Auto-Configuration](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-auto-configuration.md): 20 questions, Junior
- [Spring Boot Starters](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-starters.md): 18 questions, Junior
- [Application Properties & YAML](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/application-properties-yml.md): 16 questions, Junior
- [Logging with SLF4J & Logback](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/logging.md): 20 questions, Junior
- [Spring Boot DevTools](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-devtools.md): 15 questions, Junior
- [Spring MVC Basics](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-mvc-basics.md): 20 questions, Mid-Level
- [Spring REST Controllers](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-rest-controllers.md): 20 questions, Mid-Level
- [Request & Response Handling](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/request-response-handling.md): 20 questions, Mid-Level
- [Exception Handling](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/exception-handling.md): 25 questions, Mid-Level
- [Bean Validation](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/bean-validation.md): 25 questions, Mid-Level
- [Spring Data JPA Basics](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-data-jpa-basics.md): 25 questions, Mid-Level
- [JPA Entities & Relationships](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/jpa-entities-relationships.md): 30 questions, Mid-Level
- [JPA Queries](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/jpa-queries.md): 30 questions, Mid-Level
- [Spring Data Repositories](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-data-repositories.md): 25 questions, Mid-Level
- [Spring Security Basics](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-security-basics.md): 25 questions, Mid-Level
- [Spring Boot Actuator](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-actuator.md): 20 questions, Mid-Level
- [Unit Testing with JUnit & Mockito](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/testing-junit-mockito.md): 30 questions, Mid-Level
- [Spring Boot Testing](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-testing.md): 30 questions, Mid-Level
- [Profiles & Environment](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/profiles-environment.md): 20 questions, Mid-Level
- [RestTemplate & WebClient](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/resttemplate-webclient.md): 24 questions, Mid-Level
- [Async & Scheduling](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/async-scheduling.md): 25 questions, Mid-Level
- [Caching with Spring](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/caching.md): 25 questions, Mid-Level
- [Spring WebFlux (Reactive)](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-webflux.md): 25 questions, Mid-Level
- [Spring Transactions](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/transactions.md): 30 questions, Senior
- [JWT & Stateless Security](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/jwt-stateless-security.md): 20 questions, Senior
- [OAuth2 & Authorization Server](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/oauth2-authorization-server.md): 20 questions, Senior
- [Spring Boot & Docker](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-docker.md): 19 questions, Senior
- [Microservices with Spring](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/microservices-basics.md): 25 questions, Senior
- [Spring Cloud Config](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-cloud-config.md): 19 questions, Senior
- [Performance Optimization](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/performance-optimization.md): 30 questions, Senior
- [GraalVM Native Images](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/graalvm-native-images.md): 20 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/spring-boot/interview-questions/authentication-authorization