Spring professional certification > 42-Securing-REST-Application > Flashcards

42-Securing-REST-Application Flashcards

(69 cards)

Study These Flashcards
1
Q

List out security concepts

A 
Principal
Authentication
Authorization
Authority
Secure resource
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is authority?

A

Permission or credential enabling access. The most familiar example of authority is a role (string)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

List out 5 authentication mechanisms:

A 
Basic
Digest
Form
X.509
OAuth
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is LDAP?

A

DAP: directory access protocol
LDAP: DAP using TCP/IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does authorization do?

A

check if user has the required authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the advantages of Spring Security?

A
  1. Portable: can use for any Spring project
  2. Separation of concerns
  3. Flexible & extensible: support many:
    a. authentication mechanisms
    b. storages
    c. customizable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does AuthenticationManager do?

A 
authenticate(Authentication) return full Authentication object if successful.
Throw AuthenticationException or sub-class if fails
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What inside Authentication?

A
  1. List of GrantedAuthority
  2. Principal: Object
  3. Credentials: Object
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does AccessDecisionManager do?

A

Holding list of Voter to decide if the user allows accessing a secured resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

List out default voters in AccessDecisionManager

A
  1. RoleVoter: having the right role or not

2. AuthenticatedVoter: logged in as a valid user or not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the result of AccessDecisionManager.decide()?

A
  1. AccessDeniedException: same as 403
  2. InsufficientAuthenticationException: same as 401
  3. successful otherwise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In the big picture of Spring Security, how do components work together to protects secured resources?

A
  1. AuthenticationManager populates SecurityContext with Authentication object
  2. Security Interceptor obtains SecurityContext and passes it to AccessDecisionManager to check
  3. If pass, allow access to the secured resource
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the steps to setup Spring security in a web environment?

A
  1. Setup Filter Chain - Spring Boot does this for you
  2. Configure authorization rules
  3. Setup web authentication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How springSecurityFilterChain works with DelegatingFilterProxy?

A
  1. DelegatingFilterProxy stays in front of DispatcherServlet
  2. DelegatingFilterProxy delegates request to springSecurityFilterChain to check authentication/authorization
  3. springSecurityFilterChain having a list of filters to check the permission
  4. If successful, DelegatingFilterProxy will forward the request to DispatcherServlet
    Note: all implement javax.servlet.Filter
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

List out default filters in springSecurityFilterChain

A
  1. SecurityContextPersistenceFilter
  2. LogoutFilter
  3. UsernamePasswordAuthenticationFilter
  4. ExceptionTranslationFilter
  5. FilterSecurityInterceptor: does the hard work of performing permission checking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does SecurityContextPersistenceFilter do?

A
  1. Finds security context in session and sets it for the current thread
  2. Stores security context back into session
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does UsernamePasswordAuthenticationFilter do?

A

Puts Authentication into the SecurityContext on login request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does ExceptionTranslationFilter do?

A

Converts SpringSecurity exceptions into HTTP response or redirect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the default username?

A

user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How to configure custom security for your application?

A

@Configuration
@EnableWebSecurity // not need if Spring Boot
class ClassName extends WebSecurityConfigurerAdapter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How to enable security in a web app?

A

Using @EnableWebSecurity if not using Spring Boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Ant style: /admin/* vs. /admin/**

A

/admin/** any path under /admin

/admin/* only matches /admin/xxx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

antMatchers vs. mvcMatchers

A

Similar but there are some issue with antMatchers e.g. antMatchers(“/admin”) matches “/admin/”: potential security risk
mvcMatchers: recommended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Overloads of mvcMatchers

A
  1. mvcMatchers(path1, path2)

2. mvcMatchers(httpMethod, path)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
hasRole vs. hasAnyRole
e. g. hasRole(roleName) | e. g. hasAnyRole(roleName1, roleName2)
26
What is the prefix value of authority?
ROLE_
27
Write custom role checking?
Using SpEL: | mvcMatchers("...").access("hasRole('ADMIN') && hasRole('USER')")
28
Service to get user?
UserDetailsService.loadUserByUsername(String username): UserDetails
29
Web security: how to authorize a URL?
1. Override WebSecurityConfigurerAdapter.configure(HttpSecurity) 2. Using mvcMatcchers().hasRole()
30
How to ignore all permission checking on static resources?
1. Override WebSecurityConfigurerAdapter.configure(WebSecurity) 2. web.ignoring().mvcMatchers(...)
31
How to configure AuthenticationManager?
Override WebSecurityConfigurerAdapter.configure(AuthenticationManagerBuilder)
32
What is the authentication flow for basic authentication?
1. Request goes to BasicAuthenticationFilter (extends UsernamePasswordAuthenticationToken) 2. Calling auth = AuthenticationManager.authenticate(Authentication) a. Fail if throwing AuthenticationException b. Fully Authentication object otherwise 3. AuthenticationManager is a ProviderManager that contains a list of AuthenticationProvider a. Loop through all AuthenticationProvider b. Call AuthenticationProvider.supports(Class> authenticationClass) if true, call AuthenticationProvider.authenticate(Authentication) forwards result to ProviderManager. If AuthenticationProvider is a DaoAuthenticationProvider, it calls UserDetailsService to lookup for user
33
Where is Authentication stored?
SecurityContextHolder
34
How to authenticate with the basic authentication mechanism?
Calculate token = base64 value of username:password Put in the header: authentication: Basic $token
35
Implementations of AuthenticationProvider
1. DaoAuthenticationProvider 2. LdapAuthenticationProvider 3. OpenIDAuthenticationProvider 4. RememberMeAuthenticationProvider
36
Implementations of UserDetailsService
InMemoryUserDetailsManager JdbcUserDetailsManager LdapUserDetailsManager
37
How to configure user and role using InMemoryUserDetailsManager?
1. Override WebSecurityConfigurerAdapter.configure(AuthenticationManagerBuilder auth) 2. Configure: auth.inMemoryAuthentication() .withUser(username).password(passwordEncoder.encode(pw)).roles(roleName) // .and().with... next user
38
How to configure JdbcUserDetailsManager?
1. Override WebSecurityConfigurerAdapter.configure(AuthenticationManagerBuilder auth) 2. Configure auth. jdbcAuthentication().dataSource(ds)
39
How to configure custom UserDetailsService?
Just implement UserDetailsService interface and mark it with @Service. DaoAuthenticationProvider will find and use it
40
How to add a custom AuthenticationProvider?
1. Override WebSecurityConfigurerAdapter.configure(AuthenticationManagerBuilder auth) and annotate with @Configuration 2. Add auth. authenticationProvider(customAuthenticationProvider)
41
What is password encoded format?
{encoderId}encodedPassword example: {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
42
What is the default password encoder?
BcryptPasswordEncoder
43
How to encode a password?
PasswordEncoderFactories.createDelegatingPasswordEncoder().encode(password);
44
What class manages all password encoders?
DelegatingPasswordEncoder
45
Does Spring provide a default login page?
yes
46
How to enable basic authentication?
1. Override WebSecurityConfigurerAdapter.configure(HttpSecurity) 2. Configure http.authorizeRequests() ... .and() .httpBasic();
47
Which layer is recommended for method security?
service layer beans
48
What exception will be thrown if method access is not allowed?
AccessDeniedException
49
How to enable method security JSR-250?
@EnableGlobalMethodSecurity(jsr250Enabled=true)
50
How to set role-required for a method using method security JSR-250?
@RoleAllowed("ROLE_ADMIN") | public void method() {}
51
How to set role-required "ADMIN" for a method using method security JSR-250?
Must use full-name ROLE_ADMIN instead of ADMIN @RoleAllowed("ROLE_ADMIN") public void method() {}
52
How to enable method security?
@EnableGlobalMethodSecurity(prePostEnabled=true)
53
How to check role and argument with method security?
@PreAuthorize("hasRole('ADMIN') && #order.id == 1") | public Item findItem(Order order) {}
54
How to check role and return value with method security?
@PostAuthorize("hasRole('ADMIN') && returnObject.id == 1") | public Item findItem(Order order) {}
55
How to enable @Secured?
@Configuration | @EnableGlobalMethodSecurity(securedEnabled = true)
56
What can we do with @Secured?
``` Check role only e.g. @Secured({"ROLE_A", "ROLE_B"}) void method() ```
57
How to test the controller with spring security?
1. Add @WebMvcTest(Controller.class) to test class a. Override config if needed: @ContextConfiguration(classes={Config1.class, Config2.class}) 2. Mock role @Test @WithMockUser(roles={"ADMIN"}) void testClass() {} 3. Using mockMvc.perform to test
58
In the integration test, how to perform a test with username and password?
1. Add @SpringBootTest(webEnvironment=RANDOM_PORT) | 2. Using TestRestTemplate.withBasicAuth(username, password)
59
By default, what is the first filter in the spring filter chain?
springSecurityFilterChain | Note: with postfix Chain
60
What does springSecurityFilterChain do through Spring-managed filters?
1. Drive authentication 2. Enforce authorization 3. Manage logout 4. Maintain SecurityContext in HttpSession 5. and more
61
What is the relationship between ExceptionTranslationFilter and FilterSecurityInterceptor?
1. ExceptionTranslationFilter does nothing on request 2. FilterSecurityInteceptor does the hard work of performing the security check, but only raises an exception if the request is rejected 3. ExceptionTranslationFilter handles exception if exists and responds to the client.
62
How to replace an existing filter?
1. Must extend the filter being replaced e.g. class Custom extends UsernamePasswordAuthenticationFilter {} 2. Create bean @Bean Filter loginFilter() {} 3. Override WebSecurityConfigurerAdapter.configure(HttpSecurity) 4. http.addFilter(loginFilter()); Note: the order will be taken care by Spring
63
How to add a custom filter?
1. class Custom implements Filter {} 2. Create bean for the filter 3. Override WebSecurityConfigurerAdapter.configure(HttpSecurity) 4. http.addFilterAfter(custom, UsernamePasswordAuthenticationFilter.class)
64
@EnableGlobalMethodSecurity is annotation used in Spring Security to secure which layer?
Service layer
65
In Spring Security, what is the name of the class holding the information regarding high-level user permissions?
Represents an authority granted to an Authentication object. | A GrantedAuthority must either represent itself as a String or be specifically supported by an AccessDecisionManager.
66
In Spring Security, what is the name of the Servlet Filter intercepting all the requests sent to an application?
DelegatingFilterProxy
67
In sprint security, how to filter data return by a function?
Using @PostFilter: data returned by a method can be filtered by a security restriction There is also a @PreFilter but it is less commonly used.
68
What do SpEL expressions starting with @ reference?
Spring bean
69
Annotation equivalent to @RoleAllowed
@Secured
Spring professional certification
flashcards
Decks in class (18)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions