Most Asked Spring Security Interview Questions in 2026

Most Asked Spring Security Interview Questions in 2026 Work through these 12 questions out loud. Open any question for the full model answer, the trap to avoid, and the follow-up a panel usually asks.

  1. Why is ThreadLocal problematic with virtual threads?

    Libraries storing per-request state in ThreadLocal allocate one entry per virtual thread — catastrophic memory with 100k concurrent requests. Prefer ScopedValue for request...

    Full answer

  2. What changed migrating Spring Boot 2 to Spring Boot 3 (Jakarta EE)?

    Upgrade to Java 17+, replace imports javax.persistence → jakarta.persistence, update Spring Security config to SecurityFilterChain lambda DSL, run OpenRewrite migration recipe,...

    Full answer

  3. How do you enable virtual threads in Spring Boot 3.2+?

    application.yml: spring.threads.virtual.enabled=true on Java 21. Verify integration tests pass — especially security, transactions, MDC logging. Replace custom fixed thread...

    Full answer

  4. springdoc-openapi vs legacy springfox — what should new projects use?

    Add springdoc-openapi-starter-webmvc-ui dependency. Annotate with @Operation, @Schema on DTOs. Disable in prod via springdoc.api-docs.enabled=false or secure endpoint. Generate...

    Full answer

  5. How configure Spring Security OAuth2 Resource Server for JWT?

    Configure issuer-uri pointing to IdP. SecurityFilterChain: authorizeHttpRequests(auth ->...

    Full answer

  6. Explain OAuth2 Authorization Code flow with PKCE for SPAs.

    React app redirects to IdP with code_challenge. Callback with code sent to Spring BFF /oauth/callback — BFF exchanges with code_verifier + client_secret. BFF sets session...

    Full answer

  7. How does @PreAuthorize method security work in Spring Security 6?

    @EnableMethodSecurity @Service class with @PreAuthorize hasAuthority order:cancel on cancelOrder(). Use @PostAuthorize for return value checks. Combine with SecurityFilterChain...

    Full answer

  8. Why use BCrypt PasswordEncoder and how to configure it?

    @Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); } — userService saves encoder.encode(rawPassword). Login: authenticationManager with...

    Full answer

  9. Explain immutability and why String is immutable.

    Immutable objects cannot change after build — thread-safe without synchronization. String immutability allows intern pool, caching hashCode, and security when used as...

    Full answer

  10. Explain JWT authentication flow in Spring Security.

    POST /login with credentials → auth provider validates → issue JWT with exp/sub/roles. Subsequent requests include Bearer token. JwtAuthenticationFilter runs before...

    Full answer

  11. What are Spring Boot starters?

    spring-boot-starter-web brings spring-webmvc, Tomcat, Jackson with tested versions and enables WebMvcAutoConfiguration. You declare one starter instead of 10 coordinates....

    Full answer

  12. What is CSRF and how does Spring Security handle it?

    CSRF tricks logged-in user's browser to POST to your site. Spring stores CsrfToken and validates on mutating requests. For SPA with session cookies, expose token via...

    Full answer

Spring Security Interview Questions and Answers · Top 50 Spring Security Interview Questions and Answers (2026 Edition) · Top 40 Spring Security Interview Questions | Must-Prepare before interview. · Spring Security Interview Questions Every Fresher Must Know

All interview question lists · Interview guides · Home · Support the platform