Backend interview prep

Start

Spring Security Method-Level Security Interview Questions and Answers

Master Spring Security Method-Level Security with interview questions covering @EnableMethodSecurity, @PreAuthorize, @PostAuthorize, @Secured, @RolesAllowed, SpEL, custom authorization, and production-ready security practices.

Introduction

Securing URLs alone is not enough for enterprise applications.

Consider a banking application.

Even if only authenticated users can access

GET /accounts/{id}

how do we ensure that Customer A cannot access Customer B's account?

This is where Method-Level Security becomes essential.

Method-Level Security protects service and controller methods using annotations and authorization expressions.

It provides

  • Role-Based Access Control (RBAC)
  • Authority-Based Security
  • Object-Level Security
  • Expression-Based Authorization
  • Business Rule Security

Method-Level Security is widely used in

  • Banking
  • Healthcare
  • Insurance
  • Government
  • Enterprise ERP Systems

Method Security Architecture

flowchart LR

Client --> SecurityFilterChain

SecurityFilterChain --> Controller

Controller --> MethodSecurityInterceptor

MethodSecurityInterceptor --> Service

Service --> Database

Q1. What is Method-Level Security?

Answer

Method-Level Security secures individual Java methods.

Instead of protecting only URLs,

Spring Security checks permissions before executing methods.

Examples

  • Transfer Money
  • Delete Customer
  • Approve Loan
  • View Salary

This provides fine-grained authorization.

Q2. How do you enable Method-Level Security?

Spring Boot 3 uses

@EnableMethodSecurity

Example

@Configuration
@EnableMethodSecurity
public class SecurityConfig {

}

This enables

  • @PreAuthorize
  • @PostAuthorize
  • @Secured
  • @RolesAllowed

Q3. What is @PreAuthorize?

@PreAuthorize checks authorization before executing a method.

Example

@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(){

}

If authorization fails,

the method is never executed.

Q4. What is @PostAuthorize?

@PostAuthorize executes after the method finishes.

Example

@PostAuthorize(
    "returnObject.owner == authentication.name"
)

Useful for

  • Object ownership
  • Row-level security
  • Data filtering

Post Authorization

flowchart LR

Method --> Result

Result --> SecurityCheck

SecurityCheck --> Return

Q5. What is @Secured?

@Secured protects methods using roles.

Example

@Secured("ROLE_ADMIN")
public void deleteCustomer(){

}

It only supports role checks.

No SpEL expressions.

Q6. What is @RolesAllowed?

@RolesAllowed comes from Jakarta Security.

Example

@RolesAllowed("ADMIN")
public void createUser(){

}

It behaves similarly to @Secured.

Q7. What is SpEL in Method Security?

Spring Expression Language (SpEL) enables dynamic authorization.

Examples

@PreAuthorize(
    "hasRole('ADMIN')"
)

@PreAuthorize(
    "#id == authentication.name"
)

@PreAuthorize(
    "hasAuthority('TRANSFER_FUNDS')"
)

SpEL provides flexible security rules.

Q8. Can Method Security protect service methods?

Yes.

This is the recommended approach.

Architecture

flowchart LR

Controller --> Service

Service --> MethodSecurity

MethodSecurity --> Database

Service-level security protects business logic even if multiple controllers invoke the same service.

Q9. What happens if authorization fails?

Spring throws

AccessDeniedException

The client receives

HTTP 403 Forbidden

The protected method is not executed.

Q10. Method Security Best Practices

Secure Service Layer

Protect business logic.

Prefer @PreAuthorize

Most common annotation.

Use Authorities for Business Permissions

Examples

  • APPROVE_LOAN
  • TRANSFER_FUNDS

Avoid Hardcoding User Names

Use roles and authorities.

Log Authorization Failures

Support auditing.

Banking Example

flowchart TD

Customer --> TransferController

TransferController --> PaymentService

PaymentService --> PreAuthorize

PreAuthorize --> TransferFunds

TransferFunds --> Database

Only customers with the required authority can transfer money.

Common Interview Questions

  • What is Method-Level Security?
  • How do you enable Method Security?
  • What is @PreAuthorize?
  • What is @PostAuthorize?
  • What is @Secured?
  • What is @RolesAllowed?
  • What is SpEL?
  • Can Method Security secure service methods?
  • What happens when authorization fails?
  • Method Security best practices?

Quick Revision

Topic Summary
Method Security Secures Java methods
@EnableMethodSecurity Enables method security
@PreAuthorize Check before execution
@PostAuthorize Check after execution
@Secured Role-based security
@RolesAllowed Jakarta role security
SpEL Dynamic authorization
AccessDeniedException Authorization failure
HTTP 403 Access denied
Service Security Recommended

Complete Method Security Lifecycle

sequenceDiagram
Client->>SecurityFilterChain: HTTP Request
SecurityFilterChain->>Controller: Request Allowed
Controller->>MethodSecurityInterceptor: Invoke Service
MethodSecurityInterceptor->>SecurityContextHolder: Read Authentication
SecurityContextHolder-->>MethodSecurityInterceptor: Roles & Authorities
MethodSecurityInterceptor-->>Service: Authorized
Service-->>Controller: Result
Controller-->>Client: HTTP Response

Production Example – Banking Fund Transfer

A banking application exposes

POST /payments

Business Rule

Only users having

TRANSFER_FUNDS

authority may execute transfers.

@Service
public class PaymentService {

    @PreAuthorize(
        "hasAuthority('TRANSFER_FUNDS')"
    )
    public PaymentResponse transfer(
            PaymentRequest request){

        return processTransfer(request);

    }

}

Workflow

  1. Customer authenticates.

  2. JWT stores user authorities.

  3. Security Filter Chain authenticates the request.

  4. PaymentController invokes PaymentService.

  5. @PreAuthorize checks for the TRANSFER_FUNDS authority.

  6. If authorized:

    • Transfer executes.

  7. Otherwise:

    • HTTP 403 Forbidden is returned.
flowchart LR

Customer --> JWTAuthentication

JWTAuthentication --> SecurityContextHolder

SecurityContextHolder --> PaymentController

PaymentController --> PaymentService

PaymentService --> PreAuthorize

PreAuthorize --> PostgreSQL

@PreAuthorize vs @PostAuthorize vs @Secured

Feature @PreAuthorize @PostAuthorize @Secured
Executes Before Method ✅ ❌ ✅
Executes After Method ❌ ✅ ❌
Supports SpEL ✅ ✅ ❌
Role Checks ✅ ✅ ✅
Authority Checks ✅ ✅ ❌
Object-Level Security Limited Excellent ❌
Recommended ✅ Specific use cases Legacy/simple role checks

Common SpEL Expressions

Expression Meaning
hasRole('ADMIN') User has ADMIN role
hasAnyRole('ADMIN','MANAGER') Any listed role
hasAuthority('TRANSFER_FUNDS') Specific permission
hasAnyAuthority(...) Any listed permission
isAuthenticated() User is authenticated
isAnonymous() Anonymous user
#id == authentication.name Compare method parameter with current user
returnObject.owner == authentication.name Verify ownership after execution

URL Security vs Method Security

URL Security Method Security
Protects endpoints Protects Java methods
Configured in SecurityFilterChain Configured using annotations
Coarse-grained Fine-grained
Request-based Business-rule based
Can be bypassed by internal calls Protects business logic directly

Enterprise Security Architecture

flowchart TD

Client --> SecurityFilterChain

SecurityFilterChain --> Controller

Controller --> Service

Service --> MethodSecurity

MethodSecurity --> BusinessRules

BusinessRules --> Database

Key Takeaways

  • Method-Level Security protects individual controller and service methods, providing fine-grained authorization beyond URL security.
  • Enable Method-Level Security using @EnableMethodSecurity in Spring Boot 3.
  • @PreAuthorize is the most commonly used annotation because it validates permissions before method execution.
  • @PostAuthorize is useful for object-level authorization where access decisions depend on the returned object.
  • @Secured and @RolesAllowed provide simple role-based security but are less flexible than @PreAuthorize.
  • Spring Expression Language (SpEL) enables dynamic authorization based on roles, authorities, method parameters, and returned objects.
  • Protecting the service layer ensures business rules remain secure regardless of how methods are invoked.
  • Combining URL security with Method-Level Security provides a robust, enterprise-grade authorization strategy for Spring applications.