Java Spring Security
A filter chain in front of everything. Most confusion comes from not knowing the request never reaches your controller.
4 concepts · 9 interview questions
What this topic covers
Every concept in spring security, and the questions each one gets asked as. Where a question links, it has a full write-up.
The security filter chain
An ordered chain of servlet filters that authenticates and authorises before the DispatcherServlet is reached at all.
- How does Spring Security intercept a request?
- Why does my @ControllerAdvice not catch a 403?
Authentication
Establishing who the caller is, then storing it in a SecurityContext bound to the thread for the request.
- How is the authenticated user made available to your code?
- How do you implement JWT authentication?
- Session versus token authentication — what changes?
Passwords and secrets
Hashing with a deliberately slow algorithm and a per-password salt, and keeping secrets out of the repository.
- How should passwords be stored?
- Why is a salt not a secret?