Cracking the Spring Security Interview: Tips and Must-Know Questions

Cracking the Spring Security Interview: Tips and Must-Know Questions Work through these 12 questions out loud. Open any question for the full model answer, the trap to avoid, and the follow-up a panel usually asks.

  1. What is CSRF and how does Spring Security handle it?

    CSRF tricks logged-in user's browser to POST to your site. Spring stores CsrfToken and validates on mutating requests. For SPA with session cookies, expose token via...

    Full answer

  2. What changed migrating Spring Boot 2 to Spring Boot 3 (Jakarta EE)?

    Upgrade to Java 17+, replace imports javax.persistence → jakarta.persistence, update Spring Security config to SecurityFilterChain lambda DSL, run OpenRewrite migration recipe,...

    Full answer

  3. How do you enable virtual threads in Spring Boot 3.2+?

    application.yml: spring.threads.virtual.enabled=true on Java 21. Verify integration tests pass — especially security, transactions, MDC logging. Replace custom fixed thread...

    Full answer

  4. Explain OAuth2 Authorization Code flow with PKCE for SPAs.

    React app redirects to IdP with code_challenge. Callback with code sent to Spring BFF /oauth/callback — BFF exchanges with code_verifier + client_secret. BFF sets session...

    Full answer

  5. How does @PreAuthorize method security work in Spring Security 6?

    @EnableMethodSecurity @Service class with @PreAuthorize hasAuthority order:cancel on cancelOrder(). Use @PostAuthorize for return value checks. Combine with SecurityFilterChain...

    Full answer

  6. What are Spring Boot starters?

    spring-boot-starter-web brings spring-webmvc, Tomcat, Jackson with tested versions and enables WebMvcAutoConfiguration. You declare one starter instead of 10 coordinates....

    Full answer

  7. springdoc-openapi vs legacy springfox — what should new projects use?

    Add springdoc-openapi-starter-webmvc-ui dependency. Annotate with @Operation, @Schema on DTOs. Disable in prod via springdoc.api-docs.enabled=false or secure endpoint. Generate...

    Full answer

  8. Why use BCrypt PasswordEncoder and how to configure it?

    @Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); } — userService saves encoder.encode(rawPassword). Login: authenticationManager with...

    Full answer

  9. Explain JWT authentication flow in Spring Security.

    POST /login with credentials → auth provider validates → issue JWT with exp/sub/roles. Subsequent requests include Bearer token. JwtAuthenticationFilter runs before...

    Full answer

  10. Why is ThreadLocal problematic with virtual threads?

    Libraries storing per-request state in ThreadLocal allocate one entry per virtual thread — catastrophic memory with 100k concurrent requests. Prefer ScopedValue for request...

    Full answer

  11. How configure Spring Security OAuth2 Resource Server for JWT?

    Configure issuer-uri pointing to IdP. SecurityFilterChain: authorizeHttpRequests(auth ->...

    Full answer

  12. Explain immutability and why String is immutable.

    Immutable objects cannot change after build — thread-safe without synchronization. String immutability allows intern pool, caching hashCode, and security when used as...

    Full answer

Spring Security Interview Questions and Answers · Top 50 Spring Security Interview Questions and Answers (2026 Edition) · Top 40 Spring Security Interview Questions | Must-Prepare before interview. · Spring Security Interview Questions Every Fresher Must Know

All interview question lists · Interview guides · Home · Support the platform