# Spring Security Basics (Spring Boot)

> Spring Security, authentication, authorization, SecurityFilterChain, UserDetailsService, PasswordEncoder

- 25 interview questions
- Mid-Level
- [Interview Questions: Spring Boot](https://sharpskill.dev/en/technologies/spring-boot/interview-questions.md)

## 1. What is Spring Security?

**Answer**

Spring Security is a security framework for Spring applications that provides authentication and authorization features. It protects applications against common attacks (CSRF, XSS, session fixation) and offers integration with various authentication mechanisms (form login, HTTP Basic, OAuth2, JWT). The framework uses a filter chain (Security Filter Chain) to intercept and process HTTP requests before they reach controllers.

## 2. What is the difference between authentication and authorization in Spring Security?

**Answer**

Authentication verifies user identity (who are you?), typically via username/password, while authorization verifies permissions (what can you do?). Authentication happens first and creates a SecurityContext with user information. Authorization then uses this information to decide if the user can access a specific resource. For example, a user can be successfully authenticated but not authorized to access /admin if their role is USER and not ADMIN.

## 3. What is the SecurityContext in Spring Security?

**Answer**

The SecurityContext is an object that contains the security information of the currently authenticated user, primarily the Authentication object. It is stored in the SecurityContextHolder and accessible throughout request processing. After successful authentication, Spring Security creates a SecurityContext containing an Authentication with user details (username, authorities, credentials). This context allows the application to check who the current user is and what their permissions are.

## 22 more questions available

- How does SecurityContextHolder store the SecurityContext by default?
- What is the role of the UserDetails interface in Spring Security?

Sign up for free: https://sharpskill.dev/en/login

## Other Spring Boot interview topics

- [Spring Core - IoC & DI](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-core-ioc-di.md): 22 questions, Junior
- [Spring Boot Auto-Configuration](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-auto-configuration.md): 20 questions, Junior
- [Spring Boot Starters](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-starters.md): 18 questions, Junior
- [Application Properties & YAML](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/application-properties-yml.md): 16 questions, Junior
- [Logging with SLF4J & Logback](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/logging.md): 20 questions, Junior
- [Spring Boot DevTools](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-devtools.md): 15 questions, Junior
- [Spring MVC Basics](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-mvc-basics.md): 20 questions, Mid-Level
- [Spring REST Controllers](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-rest-controllers.md): 20 questions, Mid-Level
- [Request & Response Handling](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/request-response-handling.md): 20 questions, Mid-Level
- [Exception Handling](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/exception-handling.md): 25 questions, Mid-Level
- [Bean Validation](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/bean-validation.md): 25 questions, Mid-Level
- [Spring Data JPA Basics](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-data-jpa-basics.md): 25 questions, Mid-Level
- [JPA Entities & Relationships](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/jpa-entities-relationships.md): 30 questions, Mid-Level
- [JPA Queries](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/jpa-queries.md): 30 questions, Mid-Level
- [Spring Data Repositories](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-data-repositories.md): 25 questions, Mid-Level
- [Spring Boot Actuator](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-actuator.md): 20 questions, Mid-Level
- [Unit Testing with JUnit & Mockito](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/testing-junit-mockito.md): 30 questions, Mid-Level
- [Spring Boot Testing](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-testing.md): 30 questions, Mid-Level
- [Profiles & Environment](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/profiles-environment.md): 20 questions, Mid-Level
- [RestTemplate & WebClient](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/resttemplate-webclient.md): 24 questions, Mid-Level
- [Async & Scheduling](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/async-scheduling.md): 25 questions, Mid-Level
- [Caching with Spring](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/caching.md): 25 questions, Mid-Level
- [Spring WebFlux (Reactive)](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-webflux.md): 25 questions, Mid-Level
- [Spring Transactions](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/transactions.md): 30 questions, Senior
- [Advanced Authentication & Authorization](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/authentication-authorization.md): 30 questions, Senior
- [JWT & Stateless Security](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/jwt-stateless-security.md): 20 questions, Senior
- [OAuth2 & Authorization Server](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/oauth2-authorization-server.md): 20 questions, Senior
- [Spring Boot & Docker](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-boot-docker.md): 19 questions, Senior
- [Microservices with Spring](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/microservices-basics.md): 25 questions, Senior
- [Spring Cloud Config](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-cloud-config.md): 19 questions, Senior
- [Performance Optimization](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/performance-optimization.md): 30 questions, Senior
- [GraalVM Native Images](https://sharpskill.dev/en/technologies/spring-boot/interview-questions/graalvm-native-images.md): 20 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/spring-boot/interview-questions/spring-security-basics