Top 20 Spring Security Interview Questions and Answers

Top 20 Spring Security Interview Questions and Answers Work through these 20 questions out loud. Open any question for the full model answer, the trap to avoid, and the follow-up a panel usually asks.

1. How do you implement RBAC in React without treating the UI as security?

   I ship access.ts with can(user, "interview:question:delete") and wrap dangerous UI in <Can>. Routes use RequirePermission. Spring has the same permission on the controller. On...

   Full answer

2. Why is storing a JWT in localStorage a problem, and what do you do instead with Spring Security?

   I prefer BFF: Vite proxies /api, Spring sets httpOnly cookie, React never sees the JWT. If I must use a bearer token, I keep access token in memory and refresh via cookie. I...

   Full answer

3. Explain immutability and why String is immutable.

   Immutable objects cannot change after build — thread-safe without synchronization. String immutability allows intern pool, caching hashCode, and security when used as...

   Full answer

4. Explain JWT authentication flow in Spring Security.

   POST /login with credentials → auth provider validates → issue JWT with exp/sub/roles. Subsequent requests include Bearer token. JwtAuthenticationFilter runs before...

   Full answer

5. What are Spring Boot starters?

   spring-boot-starter-web brings spring-webmvc, Tomcat, Jackson with tested versions and enables WebMvcAutoConfiguration. You declare one starter instead of 10 coordinates....

   Full answer

6. What is CSRF and how does Spring Security handle it?

   CSRF tricks logged-in user's browser to POST to your site. Spring stores CsrfToken and validates on mutating requests. For SPA with session cookies, expose token via...

   Full answer

7. Why is ThreadLocal problematic with virtual threads?

   Libraries storing per-request state in ThreadLocal allocate one entry per virtual thread — catastrophic memory with 100k concurrent requests. Prefer ScopedValue for request...

   Full answer

8. What changed migrating Spring Boot 2 to Spring Boot 3 (Jakarta EE)?

   Upgrade to Java 17+, replace imports javax.persistence → jakarta.persistence, update Spring Security config to SecurityFilterChain lambda DSL, run OpenRewrite migration recipe,...

   Full answer

9. How do you enable virtual threads in Spring Boot 3.2+?

   application.yml: spring.threads.virtual.enabled=true on Java 21. Verify integration tests pass — especially security, transactions, MDC logging. Replace custom fixed thread...

   Full answer

10. springdoc-openapi vs legacy springfox — what should new projects use?

    Add springdoc-openapi-starter-webmvc-ui dependency. Annotate with @Operation, @Schema on DTOs. Disable in prod via springdoc.api-docs.enabled=false or secure endpoint. Generate...

    Full answer

11. How configure Spring Security OAuth2 Resource Server for JWT?

    Configure issuer-uri pointing to IdP. SecurityFilterChain: authorizeHttpRequests(auth ->...

    Full answer

12. Explain OAuth2 Authorization Code flow with PKCE for SPAs.

    React app redirects to IdP with code_challenge. Callback with code sent to Spring BFF /oauth/callback — BFF exchanges with code_verifier + client_secret. BFF sets session...

    Full answer

13. How does @PreAuthorize method security work in Spring Security 6?

    @EnableMethodSecurity @Service class with @PreAuthorize hasAuthority order:cancel on cancelOrder(). Use @PostAuthorize for return value checks. Combine with SecurityFilterChain...

    Full answer

14. Why use BCrypt PasswordEncoder and how to configure it?

    @Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); } — userService saves encoder.encode(rawPassword). Login: authenticationManager with...

    Full answer

15. How configure CORS correctly in Spring Security 6?

    CorsConfiguration config = new CorsConfiguration(); config.setAllowedOrigins(List.of("https://app.example.com")); config.setAllowedMethods(List.of("GET","POST"));...

    Full answer

16. SecurityFilterChain vs deprecated WebSecurityConfigurerAdapter?

    @Bean SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.csrf(csrf -> csrf.disable()).authorizeHttpRequests(auth ->...

    Full answer

17. How implement multi-tenancy in Spring Security context?

    JWT includes tenant_id — converter sets TenantContextHolder. Base entity @Column tenantId validated on save. Repository methods always include tenant predicate — or Hibernate...

    Full answer

18. Your API works fine but returns 401 randomly. What could cause this?

    Random 401 often means token expiry mid-session, refresh not implemented, or some pods misconfigured with different signing keys. Check JWT `exp`, gateway header stripping, and...

    Full answer

19. What happens if an exception occurs inside a filter or interceptor?

    Exceptions in `Filter` bypass `@ControllerAdvice` unless handled. Filters run before MVC. ```java @Override protected void doFilterInternal(HttpServletRequest req,...

    Full answer

20. Requests work via curl but fail from frontend. Why?

    Browsers enforce CORS; curl does not. Configure allowed origins and methods. ```java @Bean CorsConfigurationSource corsConfigurationSource() { CorsConfiguration c = new...

    Full answer

Spring Security Interview Questions and Answers · Top 50 Spring Security Interview Questions and Answers (2026 Edition) · Top 40 Spring Security Interview Questions | Must-Prepare before interview. · Spring Security Interview Questions Every Fresher Must Know

All interview question lists · Interview guides · Home · Support the platform