Java Spring Security

A filter chain in front of everything. Most confusion comes from not knowing the request never reaches your controller.

4 concepts · 9 interview questions

What this topic covers

Every concept in spring security, and the questions each one gets asked as. Where a question links, it has a full write-up.

The security filter chain

An ordered chain of servlet filters that authenticates and authorises before the DispatcherServlet is reached at all.

  • How does Spring Security intercept a request?
  • Why does my @ControllerAdvice not catch a 403?

Authentication

Establishing who the caller is, then storing it in a SecurityContext bound to the thread for the request.

  • How is the authenticated user made available to your code?
  • How do you implement JWT authentication?
  • Session versus token authentication — what changes?

Authorization

Deciding what an authenticated caller may do, at URL level or method level.

  • URL-based versus method-level authorization?
  • How does @PreAuthorize work, and what are its limits?

Passwords and secrets

Hashing with a deliberately slow algorithm and a per-password salt, and keeping secrets out of the repository.

  • How should passwords be stored?
  • Why is a salt not a secret?

More in Spring and Spring Boot

See the whole reference map →