Backend interview prep

Start

Spring Security Authorization Interview Questions and Answers

Master Spring Security Authorization with interview questions covering roles, authorities, GrantedAuthority, RBAC, SecurityContext, AuthorizationManager, URL security, method security, and production best practices.

Introduction

After a user successfully logs in, the application must determine what that user is allowed to do.

This process is called Authorization.

Authentication answers:

Who are you?

Authorization answers:

What are you allowed to access?

Enterprise applications use authorization to protect sensitive resources such as

  • Bank Accounts
  • Payment APIs
  • Insurance Claims
  • Employee Records
  • Admin Dashboards
  • Customer Data

Spring Security provides a flexible authorization framework supporting

  • Role-Based Access Control (RBAC)
  • Authority-Based Access Control
  • URL Security
  • Method-Level Security
  • Expression-Based Authorization (SpEL)

Authorization Architecture

flowchart LR

Client --> SecurityFilterChain

SecurityFilterChain --> Authentication

Authentication --> AuthorizationManager

AuthorizationManager --> Controller

Controller --> Service

Service --> Database

Controller --> Response

Response --> Client

Q1. What is Authorization?

Answer

Authorization determines whether an authenticated user has permission to access a resource.

Examples

Customer

  • View Account
  • Transfer Money

Administrator

  • Manage Users
  • Reset Passwords
  • Delete Accounts

Authorization always occurs after authentication.

Q2. What is the difference between Authentication and Authorization?

Authentication Authorization
Verifies identity Verifies permissions
Login process Access control
Happens first Happens after authentication
Uses credentials Uses roles and authorities
Example: Username & Password Example: ROLE_ADMIN

Authentication proves who you are, while authorization determines what you can do.

Q3. What are Roles?

Roles represent groups of permissions.

Examples

ROLE_USER

ROLE_ADMIN

ROLE_MANAGER

ROLE_AUDITOR

Users are assigned one or more roles.

Example

John

↓

ROLE_CUSTOMER

Roles simplify permission management.

Q4. What are Authorities?

Authorities represent individual permissions.

Examples

READ_ACCOUNT

TRANSFER_FUNDS

CREATE_USER

DELETE_USER

A role is usually composed of multiple authorities.

Example

ROLE_ADMIN

↓

READ

WRITE

DELETE

Q5. What is GrantedAuthority?

GrantedAuthority represents a permission granted to a user.

Example

GrantedAuthority

Spring Security stores authorities inside the authenticated Authentication object.

Controllers and services use them during authorization.

Q6. What is RBAC (Role-Based Access Control)?

RBAC assigns permissions through roles instead of individual users.

RBAC Model

flowchart LR

User --> Role

Role --> Permission

Permission --> Resource

Benefits

  • Easy administration
  • Scalable
  • Secure
  • Enterprise standard

Q7. What is AuthorizationManager?

AuthorizationManager is responsible for making authorization decisions.

Responsibilities

  • Read Authentication
  • Check roles
  • Check authorities
  • Grant or deny access

It replaces older authorization mechanisms in modern Spring Security.

Q8. How is URL Authorization configured?

Spring Security secures endpoints using the Security Filter Chain.

Example

http.authorizeHttpRequests(auth ->
    auth
        .requestMatchers("/admin/**")
        .hasRole("ADMIN")
        .requestMatchers("/accounts/**")
        .authenticated()
        .anyRequest()
        .permitAll()
);

Common rules

  • permitAll()
  • authenticated()
  • hasRole()
  • hasAnyRole()
  • hasAuthority()
  • hasAnyAuthority()

Q9. What happens when authorization fails?

If the authenticated user lacks permission,

Spring Security returns

HTTP 403 Forbidden

Workflow

flowchart TD

AuthenticatedUser --> AuthorizationManager

AuthorizationManager --> Allowed

AuthorizationManager --> Forbidden

Forbidden --> HTTP403

Authentication succeeded, but access is denied.

Q10. Authorization Best Practices

Follow Least Privilege

Grant only required permissions.

Prefer Roles for Coarse-Grained Access

Simplify administration.

Use Authorities for Fine-Grained Access

Implement detailed permissions.

Centralize Security Rules

Avoid hardcoding permissions.

Audit Authorization Failures

Detect suspicious activity.

Banking Example

flowchart TD

Customer --> SecurityFilterChain

SecurityFilterChain --> AuthorizationManager

AuthorizationManager --> AccountController

AuthorizationManager --> PaymentController

AuthorizationManager --> AdminController

AdminController --> AccessDenied

PaymentController --> PaymentService

AccountController --> AccountService

Only authorized users can access protected resources.

Common Interview Questions

  • What is Authorization?
  • Authentication vs Authorization?
  • What are Roles?
  • What are Authorities?
  • What is GrantedAuthority?
  • What is RBAC?
  • What is AuthorizationManager?
  • How do you configure URL authorization?
  • What happens when authorization fails?
  • Authorization best practices?

Quick Revision

Topic Summary
Authorization Permission verification
Role Collection of permissions
Authority Individual permission
GrantedAuthority Spring permission abstraction
RBAC Role-Based Access Control
AuthorizationManager Makes authorization decisions
hasRole() Checks role
hasAuthority() Checks permission
HTTP 403 Access denied
Least Privilege Security principle

Complete Authorization Lifecycle

sequenceDiagram
Client->>SecurityFilterChain: HTTP Request
SecurityFilterChain->>Authentication: Verify User
Authentication-->>SecurityFilterChain: Authenticated
SecurityFilterChain->>AuthorizationManager: Check Permissions
AuthorizationManager->>SecurityContextHolder: Read Authentication
SecurityContextHolder-->>AuthorizationManager: Roles & Authorities
AuthorizationManager-->>SecurityFilterChain: Allow
SecurityFilterChain->>Controller: Continue Request
Controller-->>Client: HTTP Response

Production Example – Banking Authorization

A banking application exposes three APIs.

GET /accounts

POST /payments

DELETE /customers

Authorization rules

API Required Permission
/accounts ROLE_CUSTOMER
/payments TRANSFER_FUNDS
/customers ROLE_ADMIN

Workflow

  1. Customer authenticates successfully.

  2. Authentication is stored in the SecurityContextHolder.

  3. SecurityFilterChain forwards the request to AuthorizationManager.

  4. AuthorizationManager checks the user's roles and authorities.

  5. If authorized:

    • Request proceeds to the controller.

  6. Otherwise:

    • HTTP 403 Forbidden is returned.
http.authorizeHttpRequests(auth ->
    auth
        .requestMatchers("/accounts/**")
            .hasRole("CUSTOMER")
        .requestMatchers("/payments/**")
            .hasAuthority("TRANSFER_FUNDS")
        .requestMatchers("/admin/**")
            .hasRole("ADMIN")
        .anyRequest()
            .authenticated()
);

flowchart LR

Customer --> SecurityFilterChain

SecurityFilterChain --> Authentication

Authentication --> SecurityContextHolder

SecurityContextHolder --> AuthorizationManager

AuthorizationManager --> AccountController

AuthorizationManager --> PaymentController

AuthorizationManager --> AdminController

AdminController --> HTTP403

PaymentController --> PaymentService

AccountController --> AccountService

Roles vs Authorities

Roles Authorities
High-level permission groups Fine-grained permissions
Usually prefixed with ROLE_ No prefix required
Easier to manage More flexible
Example: ROLE_ADMIN Example: DELETE_USER
Can contain multiple authorities Represents a single permission

URL Authorization vs Method-Level Authorization

URL Authorization Method Security
Protects endpoints Protects service methods
Configured in SecurityFilterChain Uses @PreAuthorize, @PostAuthorize
Coarse-grained Fine-grained
Request-based Business logic-based

Enterprise Authorization Flow

flowchart TD

Client --> Authentication

Authentication --> SecurityContextHolder

SecurityContextHolder --> SecurityFilterChain

SecurityFilterChain --> AuthorizationManager

AuthorizationManager --> Controller

Controller --> Service

Service --> Database

Key Takeaways

  • Authorization determines what an authenticated user is allowed to access and always occurs after successful authentication.
  • Roles represent collections of permissions, while Authorities represent individual privileges.
  • GrantedAuthority is Spring Security's abstraction for storing permissions associated with an authenticated user.
  • Role-Based Access Control (RBAC) simplifies enterprise security by assigning permissions through roles rather than directly to users.
  • AuthorizationManager is the modern Spring Security component responsible for evaluating authorization decisions.
  • URL authorization is configured in the SecurityFilterChain, while business-level authorization is implemented using method-level security.
  • Failed authorization results in HTTP 403 Forbidden, indicating that the user is authenticated but lacks sufficient privileges.
  • Applying the principle of least privilege, centralized authorization rules, and comprehensive auditing helps build secure, maintainable enterprise applications.