Spring Boot Security Basics — Spring Technical Interview Questions & Answers

Adding spring-boot-starter-security to protect endpoints.

Spring Boot Security Basics

  • Spring Security protects who can access what in your app.
  • Authentication: Who are you? (login/identity).
  • Authorization: What are you allowed to do? (roles/permissions).
  • starter-security can lock endpoints by default until you configure rules.
  • Common forms: form login, basic auth, JWT in APIs (project-dependent).
  • Leaving default password/user in production.
  • AuthN vs AuthZ in one sentence each, then mention starter-security.

Technical Interview Tip: Define AuthN/AuthZ, then say Security filters requests.

Code Examples for Spring Boot Security Basics

Spring Boot Security Basics — working example

// spring-boot-starter-security
// Example idea: permit health + auth, require auth elsewhere

@RestController
@RequestMapping("/api/auth")
class AuthController {
  @PostMapping("/login")
  Map<String, String> login(@RequestBody LoginRequest req) {
    // validate → return token
    return Map.of("token", "demo-jwt");
  }
}

// SecurityFilterChain bean configures authorizeHttpRequests + CSRF for APIs

Spring Boot Security Basics — spring Security filters the request chain; APIs often use token auth and disable browser CSRF patterns.

How to Explain Spring Boot Security Basics to an Interviewer

What is Boot Security Basics (sb misc intro)?

Used for a tiny REST app localhost:8080 Not just the heading

Give one small example of Boot Security Basics (sb misc intro).

@SpringBootApplication + one controller Adding spring-boot-starter-security to protect endpoints

What mistake do beginners make with Boot Security Basics (sb misc intro)?

calling Boot ‘just Spring XML’ Show the fix

Where do you use Boot Security Basics (sb misc intro)?

localhost:8080 a tiny REST app