Understand authentication, authorization, filters, password encoding, and role-based access control.
Security · framework model
Use the strong answer as your reference, explain it aloud in your own words, then choose how soon you want to review it again.
Interview prompt
Strong answer
Spring Security plugs a chain of servlet filters in front of the DispatcherServlet through DelegatingFilterProxy and FilterChainProxy. An authentication filter extracts credentials, an AuthenticationManager delegates to AuthenticationProviders, and a successful Authentication is stored in the SecurityContext for the request. Authorization then runs at the HTTP layer through the AuthorizationFilter and at the method layer through @PreAuthorize, using authorities rather than hard-coded user checks.
Key points
Interviewer looks for
Trace a request through the filter chain, explain where the SecurityContext lives, and show that you know URL rules alone do not prevent insecure direct object references.
Java example
1@Configuration
2@EnableMethodSecurity
3class SecurityConfig {
4
5 @Bean
6 SecurityFilterChain api(HttpSecurity http) throws Exception {
7 return http
8 .csrf(csrf -> csrf.ignoringRequestMatchers("/api/**"))
9 .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
10 .authorizeHttpRequests(auth -> auth
11 .requestMatchers("/actuator/health", "/api/public/**").permitAll()
12 .requestMatchers(HttpMethod.DELETE, "/api/**").hasRole("ADMIN")
13 .anyRequest().authenticated())
14 .oauth2ResourceServer(oauth -> oauth.jwt(Customizer.withDefaults()))
15 .build();
16 }
17
18 @Bean
19 PasswordEncoder passwordEncoder() {
20 return PasswordEncoderFactories.createDelegatingPasswordEncoder();
21 }
22}Topic interview questions
These questions are tied to this lesson. Read each question aloud, then compare your explanation with the strong answer.
Strong answer
The servlet container calls DelegatingFilterProxy, which hands off to FilterChainProxy. It selects the matching SecurityFilterChain and runs filters for things like CSRF, authentication, exception translation, and authorization before the request reaches the controller.
Strong answer
AuthenticationManager, usually ProviderManager, receives an unauthenticated Authentication and asks each AuthenticationProvider whether it supports it. A provider such as DaoAuthenticationProvider loads the user, checks the password with the PasswordEncoder, and returns an authenticated token with authorities.
Strong answer
An authority is any granted permission string. A role is a convention where the authority carries the ROLE_ prefix, so hasRole("ADMIN") checks for ROLE_ADMIN. Fine-grained authorities such as order:refund often model permissions better than a few broad roles.
Strong answer
Keep it enabled whenever the browser sends credentials automatically, such as session cookies, because a malicious site can trigger authenticated requests. It is reasonable to disable it only for stateless APIs that authenticate with an Authorization header the browser does not attach automatically.
Strong answer
Combine authentication with an object-level check: load the resource and compare its owner to the principal, or use @PreAuthorize with a bean method or @PostAuthorize on the returned object. Also scope repository queries by owner so missing checks fail closed.
How well do you know this?
Your review choice is saved locally and synced to your learner profile when signed in.