Spring Security OAuth2 Interview Questions and Answers
Master OAuth2 with Spring Security through interview questions covering OAuth2 architecture, grant types, Authorization Server, Resource Server, Client Registration, access tokens, refresh tokens, PKCE, and production best practices.
Introduction
Modern applications rarely manage usernames and passwords for every service.
Instead, users authenticate using trusted identity providers like
- Microsoft
- GitHub
- Okta
- Keycloak
- Auth0
- Azure Active Directory
OAuth2 is the industry-standard authorization framework that enables secure access to protected resources without exposing user credentials.
Spring Security provides first-class support for OAuth2, making it easy to build
- Single Sign-On (SSO)
- Social Login
- Enterprise Identity Integration
- API Security
- Microservice Authentication
OAuth2 Architecture
flowchart LR
User --> ClientApplication
ClientApplication --> AuthorizationServer
AuthorizationServer --> UserLogin
UserLogin --> AccessToken
AccessToken --> ResourceServer
ResourceServer --> ProtectedAPI
Q1. What is OAuth2?
Answer
OAuth2 (OAuth 2.0) is an authorization framework that allows an application to access protected resources on behalf of a user without knowing the user's password.
Example
Instead of giving your Google password to a travel application,
you authorize Google to issue an access token.
The application then uses the access token to access approved resources.
Q2. Why do we use OAuth2?
Benefits
- No password sharing
- Delegated authorization
- Single Sign-On (SSO)
- Secure API access
- Third-party integrations
- Centralized identity management
OAuth2 reduces security risks while improving user experience.
Q3. What are the main OAuth2 components?
| Component | Responsibility |
|---|---|
| Resource Owner | User |
| Client | Application requesting access |
| Authorization Server | Authenticates user and issues tokens |
| Resource Server | Hosts protected APIs |
| Access Token | Grants access to resources |
OAuth2 Components
flowchart LR
User --> Client
Client --> AuthorizationServer
AuthorizationServer --> AccessToken
AccessToken --> ResourceServer
Q4. What is an Authorization Server?
The Authorization Server
- Authenticates users
- Obtains consent
- Issues Access Tokens
- Issues Refresh Tokens
Examples
- Keycloak
- Okta
- Auth0
- Azure AD
- Google Identity
- Spring Authorization Server
Q5. What is a Resource Server?
The Resource Server hosts protected APIs.
Examples
/accounts
/payments
/orders
The Resource Server validates incoming access tokens before processing requests.
Q6. What is an Access Token?
An Access Token is issued after successful authorization.
It allows access to protected resources.
Example
Authorization:
Bearer eyJhbGciOi...
Access tokens are typically short-lived.
Q7. What is a Refresh Token?
A Refresh Token is used to obtain a new Access Token after the current one expires.
Benefits
- Better security
- Longer user sessions
- Reduced logins
Refresh Flow
flowchart LR
ExpiredAccessToken --> RefreshToken
RefreshToken --> AuthorizationServer
AuthorizationServer --> NewAccessToken
Refresh tokens should be securely stored and rotated when appropriate.
Q8. What are OAuth2 Grant Types?
Modern OAuth2 flows include
| Grant Type | Usage |
|---|---|
| Authorization Code + PKCE | SPA & Mobile Applications |
| Client Credentials | Service-to-Service Communication |
| Refresh Token | Renew Access Token |
Legacy grant types such as Implicit and Password Credentials are no longer recommended for new applications.
Q9. What is PKCE?
PKCE stands for
Proof Key for Code Exchange
It protects the Authorization Code Flow against interception attacks.
PKCE is required for
- Mobile Apps
- Single Page Applications
- Public Clients
PKCE Flow
sequenceDiagram
Client->>AuthorizationServer: Authorization Request + Code Challenge
AuthorizationServer-->>Client: Authorization Code
Client->>AuthorizationServer: Authorization Code + Code Verifier
AuthorizationServer-->>Client: Access Token
Q10. OAuth2 Best Practices
Always Use HTTPS
Protect tokens during transmission.
Use Authorization Code + PKCE
Preferred for browser and mobile applications.
Keep Access Tokens Short-Lived
Reduce exposure if compromised.
Rotate Refresh Tokens
Prevent replay attacks.
Validate Token Signature
Always verify tokens before granting access.
Banking Example
flowchart TD
Customer --> BankingApp
BankingApp --> AuthorizationServer
AuthorizationServer --> AccessToken
AccessToken --> BankingAPI
BankingAPI --> AccountController
Only valid access tokens can reach protected banking APIs.
Common Interview Questions
- What is OAuth2?
- Why do we use OAuth2?
- Explain OAuth2 components.
- What is an Authorization Server?
- What is a Resource Server?
- What is an Access Token?
- What is a Refresh Token?
- Explain OAuth2 Grant Types.
- What is PKCE?
- OAuth2 best practices?
Quick Revision
| Topic | Summary |
|---|---|
| OAuth2 | Authorization framework |
| Resource Owner | User |
| Client | Application requesting access |
| Authorization Server | Issues tokens |
| Resource Server | Protects APIs |
| Access Token | API authorization |
| Refresh Token | Obtain new access token |
| PKCE | Protects Authorization Code flow |
| Client Credentials | Service-to-service authentication |
| HTTPS | Secure transport |
Complete OAuth2 Authorization Code Flow
sequenceDiagram
User->>Client: Login
Client->>AuthorizationServer: Authorization Request
AuthorizationServer->>User: Authenticate
User-->>AuthorizationServer: Credentials
AuthorizationServer-->>Client: Authorization Code
Client->>AuthorizationServer: Exchange Code
AuthorizationServer-->>Client: Access Token + Refresh Token
Client->>ResourceServer: Bearer Access Token
ResourceServer-->>Client: Protected Resource
Production Example – Banking Application with Google Login
A banking portal allows customers to log in using their Google account.
Workflow
-
Customer clicks Login with Google.
-
Spring Security redirects the browser to Google's Authorization Server.
-
Customer authenticates with Google and grants consent.
-
Google returns an Authorization Code.
-
Spring Security exchanges the code for:
- Access Token
- Refresh Token
-
User identity is established.
-
The banking application creates or updates the local customer record.
-
Protected banking APIs become available.
http
.oauth2Login(Customizer.withDefaults());
flowchart LR
Browser --> SpringBootApp
SpringBootApp --> GoogleAuthorizationServer
GoogleAuthorizationServer --> AuthorizationCode
AuthorizationCode --> SpringBootApp
SpringBootApp --> AccessToken
AccessToken --> GoogleUserInfoAPI
GoogleUserInfoAPI --> BankingApplication
OAuth2 Grant Types Comparison
| Grant Type | Recommended Use | User Login Required |
|---|---|---|
| Authorization Code + PKCE | Web, SPA, Mobile | ✅ |
| Client Credentials | Microservice-to-Microservice | ❌ |
| Refresh Token | Renew Sessions | ❌ |
| Device Authorization | Smart TVs, IoT | ✅ |
| Implicit (Legacy) | Not Recommended | ✅ |
| Resource Owner Password (Legacy) | Not Recommended | ✅ |
OAuth2 vs JWT
| OAuth2 | JWT |
|---|---|
| Authorization framework | Token format |
| Defines authentication/authorization flow | Carries identity and claims |
| Can use JWT as access token | Often used within OAuth2 |
| Supports delegated authorization | Represents authenticated identity |
| Includes Authorization Server & Resource Server | Does not define login flow |
OAuth2 in Microservices
flowchart TD
User --> WebApplication
WebApplication --> AuthorizationServer
AuthorizationServer --> AccessToken
AccessToken --> ApiGateway["API Gateway"]
APIGateway --> UserService
APIGateway --> PaymentService
APIGateway --> LoanService
The API Gateway forwards authenticated requests to downstream microservices after validating the access token or relying on a trusted authorization infrastructure.
Spring Security OAuth2 Support
| Feature | Spring Security Support |
|---|---|
| OAuth2 Login | ✅ |
| OAuth2 Client | ✅ |
| OAuth2 Resource Server | ✅ |
| JWT Access Tokens | ✅ |
| PKCE | ✅ |
| OpenID Connect | ✅ |
| Client Credentials | ✅ |
| Spring Authorization Server Integration | ✅ |
Key Takeaways
- OAuth2 is an authorization framework that enables secure, delegated access to protected resources without sharing user passwords.
- The core OAuth2 components are the Resource Owner, Client, Authorization Server, Resource Server, and Access Token.
- The Authorization Server authenticates users and issues tokens, while the Resource Server validates access tokens before serving protected resources.
- Modern applications should use the Authorization Code Flow with PKCE for browser-based and mobile clients, and Client Credentials for service-to-service communication.
- Access Tokens should be short-lived, while Refresh Tokens provide a secure mechanism for obtaining new access tokens.
- OAuth2 does not define a token format; JWT is commonly used as the access token format in OAuth2 implementations.
- Spring Security offers built-in support for OAuth2 Login, Resource Servers, OAuth2 Clients, JWT validation, and OpenID Connect.
- HTTPS, PKCE, token validation, refresh token rotation, and centralized identity providers are essential for secure enterprise OAuth2 implementations.