Top 20 Spring Security Interview Questions
1. What is Spring Security?
Spring Security is a powerful and customizable authentication and access-control
framework for Java applications, especially Spring-based apps.
2. How does authentication work in Spring Security?
It veri es user credentials using a UserDetailsService, compares passwords, and
stores authenticated info in a SecurityContext.
3. What is authorization in Spring Security?
Authorization checks what a user can access after authentication, using
annotations like @PreAuthorize, hasRole(), etc.
4. Di erence between Authentication and Authorization?
• Authentication: Verifying identity (Who are you?)
• Authorization: Granting access (What can you do?)
5. What is a SecurityFilterChain?
It’s a chain of servlet lters that handle security concerns like authentication,
authorization, CORS, CSRF, etc.
6. How to secure REST APIs using Spring Security?
Use HttpSecurity con g to de ne which endpoints are public and which require
authentication.
7. What is the UserDetailsService interface?
It loads user-speci c data (username, password, roles) from a database or in-
memory storage for authentication.
8. How to implement custom login in Spring Security?
Customize login page using:
http.formLogin().loginPage("/custom-login")
9. What is JWT and how is it used in Spring Security?
JWT (JSON Web Token) is a stateless token used to authenticate users in REST
APIs without storing sessions.
10. How do you implement JWT in Spring Security?
Generate a JWT after login, validate it in lters, and extract user info from token for
authorization.
11. What is the purpose of @EnableWebSecurity?
It enables Spring Security and allows custom security con guration via a class
extending WebSecurityCon gurerAdapter (before Spring Security 6).
ff
fi
fi
fi
fi
fi
fi
fi
fi
12. What is CSRF?
CSRF (Cross Site Request Forgery) is an attack that tricks users into performing
actions unknowingly. Spring enables CSRF protection by default.
13. How to disable CSRF for REST APIs?
Use:
http.csrf().disable()
(only for stateless APIs, not web apps)
14. What is PasswordEncoder in Spring Security?
It’s used to hash and verify passwords securely (e.g., BCryptPasswordEncoder).
15. How do roles and authorities work in Spring Security?
Roles are assigned to users, and authorities are permissions. You can check them
with hasRole("ADMIN") or hasAuthority("READ_PRIVILEGE").
16. What is method-level security?
It’s securing methods using annotations like @PreAuthorize, @Secured, etc.
Enable it using @EnableGlobalMethodSecurity.
17. How to allow certain endpoints without authentication?
In HttpSecurity:
http.authorizeHttpRequests().requestMatchers("/public/**").permitAll();
18. How to con gure multiple user roles?
Create roles and assign them in your database or con g:
.authorizeHttpRequests().requestMatchers("/admin").hasRole("ADMIN")
19. What is OAuth2 in Spring Security?
OAuth2 allows secure delegated access (like Google login). Spring Security
supports OAuth2 login and authorization server setup.
20. How to handle exceptions in Spring Security?
Use AuthenticationEntryPoint for auth failures and AccessDeniedHandler for
authorization failures.
fi
fi
