Backend interview prep

Start

Spring Security Interview Questions and Answers

Top 10 Spring Security interview questions with Mermaid diagrams, production scenarios, Spring Security 6 architecture, and enterprise best practices.

Spring Security - Interview Questions & Answers

Spring Security is the de facto security framework for Spring Boot applications. It provides authentication, authorization, protection against common attacks, session management, OAuth2 integration, JWT support, and method-level security.

Almost every enterprise Java application uses Spring Security to secure REST APIs, web applications, and microservices.

Q1. What is Spring Security?

Answer

Spring Security is a powerful and customizable security framework for Java applications built on the Spring Framework.

It provides:

  • Authentication
  • Authorization
  • Password Encryption
  • Session Management
  • CSRF Protection
  • CORS Support
  • OAuth2 & OpenID Connect
  • JWT Authentication
  • Method-Level Security

Spring Security Architecture

flowchart LR
A[Client] --> B[Spring Security Filter Chain] --> C[Authentication] --> D[Authorization] --> E[Spring MVC Controller] --> F[Business Service] --> G[Database]

Benefits

  • Built-in security
  • Easy integration
  • Highly customizable
  • Enterprise-ready

Q2. How does Spring Security work internally?

Answer

Every incoming request first passes through the Spring Security Filter Chain before reaching the application.

The filter chain performs:

  • Authentication
  • Authorization
  • Security validation

Request Flow

flowchart TD
A[HTTP Request] --> B[Security Filter Chain] --> C[Authentication Filter] --> D[Authorization Filter] --> E[DispatcherServlet] --> F[Controller] --> G[Service]

Interview Tip

Every secured request must pass through the Security Filter Chain.

Q3. What is the Spring Security Filter Chain?

Answer

The Security Filter Chain is a sequence of filters that process every HTTP request.

Common filters include:

  • UsernamePasswordAuthenticationFilter
  • BasicAuthenticationFilter
  • BearerTokenAuthenticationFilter
  • CsrfFilter
  • CorsFilter
  • ExceptionTranslationFilter
  • AuthorizationFilter

Filter Chain

flowchart LR
A[Client Request] --> B[CORS Filter]

C[CSRF Filter] --> C[CSRF Filter]

D[Authentication Filter] --> D[Authentication Filter]

E[Authorization Filter] --> E[Authorization Filter]

F[Controller] --> F[Controller]

Each filter performs a specific security task.

Q4. What is AuthenticationManager?

Answer

AuthenticationManager is responsible for authenticating users.

It receives an authentication request and delegates it to an appropriate authentication provider.

Authentication Flow

flowchart TD
A[Login Request] --> B[AuthenticationManager] --> C[AuthenticationProvider] --> D[UserDetailsService] --> E[Database] --> F[Authenticated User]

If authentication succeeds, a valid Authentication object is returned.

Q5. What is UserDetailsService?

Answer

UserDetailsService loads user information from a data source.

It returns:

  • Username
  • Password
  • Roles
  • Authorities
  • Account Status

Loading User

flowchart LR
A[AuthenticationProvider] --> B[UserDetailsService] --> C[Database] --> D[UserDetails]

Common Sources

  • Database
  • LDAP
  • Active Directory
  • External Identity Provider

Q6. What is SecurityContext?

Answer

SecurityContext stores the authenticated user's information during request processing.

It contains:

  • Principal
  • Authorities
  • Authentication Status

Security Context Flow

flowchart TD
A[Successful Authentication] --> B[SecurityContext] --> C[Authenticated User] --> D[Controller] --> E[Service Layer]

Any component can access the authenticated user from the SecurityContext.

Q7. What authentication mechanisms does Spring Security support?

Answer

Spring Security supports multiple authentication methods.

  • Form Login
  • Basic Authentication
  • JWT Authentication
  • OAuth2 Login
  • OpenID Connect
  • LDAP
  • SAML
  • X.509 Certificates

Authentication Options

flowchart TD
A[Spring Security]

A --> B[Form Login]

A --> C[Basic Auth]

A --> D[JWT]

A --> E[OAuth2]

A --> F[OIDC]

A --> G[LDAP]

Enterprise Recommendation

Modern REST APIs typically use OAuth2 + JWT.

Q8. How does Spring Security support Authorization?

Answer

Spring Security provides authorization at multiple levels.

  • URL-Level Authorization
  • Method-Level Security
  • Role-Based Authorization
  • Authority-Based Authorization
  • Custom Authorization Managers

Authorization Flow

flowchart LR
A[Authenticated User] --> B[Role Check] --> C[Permission Check] --> D[Controller] --> E[Business Service]

Example

@PreAuthorize("hasRole('ADMIN')")

Only administrators can invoke the method.

Q9. What are the Spring Security best practices?

Answer

Follow these best practices:

  • Always use HTTPS.
  • Store passwords using BCrypt.
  • Enable Method-Level Security.
  • Use JWT for REST APIs.
  • Enable CSRF for web applications.
  • Configure CORS correctly.
  • Apply Rate Limiting.
  • Use OAuth2/OpenID Connect.
  • Log security events.
  • Keep Spring Security updated.

Secure Request Flow

flowchart TD
A[Client] --> B[HTTPS] --> C[Security Filter Chain] --> D[Authentication] --> E[Authorization] --> F[Business Logic]

Answer

Modern enterprise applications implement multiple security layers around Spring Security.

Enterprise Architecture

flowchart TD
A[Client] --> B[HTTPS] --> C[Web Application Firewall] --> D[Load Balancer] --> E[API Gateway] --> F[Spring Security Filter Chain] --> G[JWT Authentication] --> H[Method-Level Security] --> I[Business Services] --> J[Database]

Internal Spring Security Flow

flowchart LR
A[HTTP Request] --> B[Security Filter Chain] --> C[AuthenticationManager] --> D[AuthenticationProvider] --> E[UserDetailsService] --> F[SecurityContext] --> G[Authorization] --> H[Controller]

Senior Interview Tip

Spring Security is much more than authentication.

A production-ready Spring Boot application should combine:

  • Spring Security Filter Chain
  • JWT Authentication
  • OAuth2 / OpenID Connect
  • BCrypt Password Hashing
  • Method-Level Security
  • HTTPS
  • CSRF Protection (Web Apps)
  • CORS Configuration
  • Rate Limiting
  • Logging & Monitoring

Spring Security should be viewed as the central security framework, while API Gateway, WAF, encryption, and monitoring provide additional layers following the Defense in Depth principle.

Quick Revision

  • Spring Security is the standard security framework for Spring applications.
  • Every request passes through the Security Filter Chain.
  • AuthenticationManager performs authentication.
  • UserDetailsService loads user information.
  • SecurityContext stores authenticated user details.
  • Spring Security supports JWT, OAuth2, OIDC, LDAP, and Basic Authentication.
  • Method-Level Security protects business logic.
  • Always use BCrypt for password hashing.
  • Enable HTTPS and configure CORS correctly.
  • Enterprise applications combine Spring Security with API Gateway, JWT, OAuth2, and layered security.