Question 1

What is the main role of the UserDetailsService interface in Spring Security?

Accepted Answer

UserDetailsService is responsible for loading user information from the data source (database, LDAP, etc.) during authentication. Its loadUserByUsername() method returns a UserDetails object containing the username, password, roles and authorities. Spring Security then uses this information to validate credentials and build the SecurityContext.

Question 2

Which annotation enables method-level security in Spring Security 6+?

Accepted Answer

@EnableMethodSecurity is the modern annotation in Spring Security 6+ that enables method-level security. It replaces the old @EnableGlobalMethodSecurity and enables @PreAuthorize, @PostAuthorize and @Secured by default. It uses AOP proxy-based configuration to intercept method calls and check authorizations.

Question 3

When does the @PreAuthorize annotation check authorizations?

Accepted Answer

@PreAuthorize checks authorizations BEFORE method execution. If the SpEL condition returns false, an AccessDeniedException is thrown and the method is never executed. This prevents access to unauthorized resources from the start. In contrast, @PostAuthorize checks after execution, which is useful for filtering results based on the user.

Advanced Authentication & Authorization

What is the main role of the UserDetailsService interface in Spring Security?

Câu trả lời

Which annotation enables method-level security in Spring Security 6+?

Câu trả lời

When does the @PreAuthorize annotation check authorizations?

Câu trả lời

What is the main difference between hasRole() and hasAuthority() in Spring Security?

How to implement a custom UserDetailsService that loads users from a database?

Các chủ đề phỏng vấn Spring Boot khác

Spring Core - IoC & DI

Spring Boot Auto-Configuration

Spring Boot Starters

Application Properties & YAML

Logging with SLF4J & Logback

Spring Boot DevTools

Spring MVC Basics

Spring REST Controllers

Request & Response Handling

Exception Handling

Bean Validation

Spring Data JPA Basics

JPA Entities & Relationships

JPA Queries

Spring Data Repositories

Spring Security Basics

Spring Boot Actuator

Unit Testing with JUnit & Mockito

Spring Boot Testing

Profiles & Environment

RestTemplate & WebClient

Async & Scheduling

Caching with Spring

Spring WebFlux (Reactive)

Spring Transactions

JWT & Stateless Security

OAuth2 & Authorization Server

Spring Boot & Docker

Microservices with Spring

Spring Cloud Config

Performance Optimization

GraalVM Native Images

Nắm vững Spring Boot cho lần phỏng vấn tiếp theo