Spring Boot

Advanced Authentication & Authorization

Advanced authentication, fine-grained authorization with @PreAuthorize/@PostAuthorize, roles, permissions, SpEL

30 interview questions·
Senior
1

What is the main role of the UserDetailsService interface in Spring Security?

Answer

UserDetailsService is responsible for loading user information from the data source (database, LDAP, etc.) during authentication. Its loadUserByUsername() method returns a UserDetails object containing the username, password, roles and authorities. Spring Security then uses this information to validate credentials and build the SecurityContext.

2

Which annotation enables method-level security in Spring Security 6+?

Answer

@EnableMethodSecurity is the modern annotation in Spring Security 6+ that enables method-level security. It replaces the old @EnableGlobalMethodSecurity and enables @PreAuthorize, @PostAuthorize and @Secured by default. It uses AOP proxy-based configuration to intercept method calls and check authorizations.

3

When does the @PreAuthorize annotation check authorizations?

Answer

@PreAuthorize checks authorizations BEFORE method execution. If the SpEL condition returns false, an AccessDeniedException is thrown and the method is never executed. This prevents access to unauthorized resources from the start. In contrast, @PostAuthorize checks after execution, which is useful for filtering results based on the user.

4

What is the main difference between hasRole() and hasAuthority() in Spring Security?

5

How to implement a custom UserDetailsService that loads users from a database?

+27 interview questions

Master Spring Boot for your next interview

Access all questions, flashcards, technical tests, code review exercises and interview simulators.

Start for free