Disclosure: This article may contain affiliate links. When you purchase, we may earn a commission.

Top 20 Spring Security Interview Questions with Answers

Hello guys, if you are preparing for Java and Spring Developer interview then you should prepare about Spring Security. Since Security is an important topic and Spring security is the most popular framework to implement security in Java web applications, there is always a few questions based upon Spring Security in Java developer interviews. In the past, I have shared Spring Boot questionsSpring Data JPA Question, Spring Cloud Questions, and Microservices Interview Questions and in this article, I will share 20 popular Spring security questions for practice. I have also shared answers so that you can revise key Spring security concepts quickly but if you think that you need more preparation on certain topic then you can also checkout this list of best Spring Security courses where I have shared online courses to learn Spring security in depth. 

Adequately preparing for an interview is always a very important thing for anyone going for an interview to do. You cannot fail to prepare and then expect to get good results at the end because proper preparation goes hand in hand with great results. 

An interview can turn around your life so you have to treat it with the seriousness it deserves. Just imagine getting into an interview room and immediately seeing the interview panel, you realize that you are not ready at all for the interview. 

Will you run away or will you face the panel? To save yourself from such an embarrassment, you only have to do one thing and that is to get ready.

Getting ready is not just saying to yourself you are ready or telling your friends that you are ready but it entails you making a step of finding out the types of questions that are usually asked in that particular type of interview.

Once you know the kind of questions commonly asked, you will be a step higher and it will end up being an added advantage to you on the day of the interview. On my part, I have keenly thought about you and have therefore researched and compiled questions that you will not miss to find in a Spring Security interview.

20 Spring Security Interview Questions with Answers

Here are the 20 Spring security questions you can prepare to do well on Spring Developer interview. I have tried to covered important Spring security concepts through these questions but if you think something is missing, feel free to suggest ion comments. If you have a Spring security question whose answer you don't know, feel free to share in comments and I will try to answer. 

The questions that I have mentioned for you below are 20 in number and I strongly believe they will help you so much as you look forward to passing your interview. Please have a close look at them.

1. What is Spring Security?

Answer: Spring Security is basically a powerful authentication and access control framework. It is highly customizable and it mainly focuses on the provision of both authentication and authorization to Java applications.

2. What are the modules of the Spring framework?

Answer: the Spring framework has four modules as follows:

  • Test
  • Data Access
  • AOP
  • Web

3. What are some of the predefined filters used in spring security?

Answer: some of the predefined filters according to the order in which they occur are as follows

  • SecurityContextPersistenceFilter – it stores the SecurityContext contents between HTTP requests.
  • ConcurrentSessionFilter – responsibe for handling concurrent sessions.
  • UsernamePasswordAuthenticationFilter – it is the most popular authentication filter.
  • ExceptionTranslationFilter – it is responsible for handling exceptions thrown by the security interceptors.
  • FilterSecurityInterceptor – it secures HTTP resources.

4. What rules and restrictions do you have to follow in order for DelegatingFilterProxy to work as required?


  • The target bean must implement the javax.servlet.Filter interface.
  • Declaring delegating filter proxy to your web.xml as a filter is a must.
  • Filter-name element and target bean must have the same name.

5. What is the security context?

Answer: security context is defined as an interface in the Spring Security framework that defines the minimum security information that is associated with the current thread of execution.

20 Spring Security Interview Questions With Answers

6. What is PasswordEncoder?

Answer: it is a Spring security interface that provides password encoding or password hashing.

7. What are some of the essential features of Spring Security?

Answer: some of the essential features of Spring Security include:

  • It supports authentication and authorization in a very organized, comprehensive and flexible manner.
  • It integrates with Servlet API.
  • It provides optional integration with Spring Web MVC.
  • Facilitates detection and prevention of attacks.

8. What is ProviderManager in Spring Security?

Answer: ProviderManager is basically the default implementation of AuthenticationManager.

9. What is JWT?

Answer: JWT (JSON Web Tokens) are tokens which are generated by a server when user authentication takes place in a web application and thereafter sent to the client.

10. Why do you need the Intercept-url?

Answer: Intercept-url is used to define the set of URL patterns that the application is interested in to as well configure how they should be handled.

11. How many user roles are there in Spring Security?

Answer: there are a total of three user roles which are:

  • Tellers
  • Supervisors
  • Plain Users

12. What are the security layers in Spring Security framework?


  • Authentication
  • Web request security
  • Service layer and domain object security

13. In which security annotation is Spel used?


  • @PostFilter
  • @PreAuthorize
  • @PostAuthorize
  • @PreFilter

14. What is a Principal in Spring Security?

Answer: principal refers to the user who is currently logged in.

15. What is salting? What is password hashing?

Answer: salting is the process of combining random data and a password before password hashing. On the other hand, password hashing is the process of storing encrypted passwords in a database.

16. What are the types of advice in AOP?


  • After Advice
  • Before Advice
  • Throws Advice
  • Around Advice
  • After Returning Advice

17. What are the ORM’s supported by Spring?


  • JPA (Java Persistence API)
  • Hibernate
  • JDO (Java Data Objects)
  • iBatis
  • TopLink

18. What is mutual authentication?

Answer: mutual authentication is a process where both entities in a communications link validate each other. It is also known as two-way authentication.

19. What is the work of @secured and @rolesallowed?

Answer: both of these annotations provide method level security into Spring Beans. The difference between the two is that @Secured is a Spring Security annotation from version 2.0 going forward while @RolesAllowed is JSR 250 annotation.

20. Why does application go in endless loop when you try to login?

Answer: this only happens when login page is a secured resource. Ordinarily, login page should not be secured but instead marked as ROLE_ANONYMOUS.

Spring security is a very interesting area or subject that you will enjoy answering the questions during the interview if at all you have gone through the mentioned questions very well. If you have not mastered all the above questions, please take your time and go through the questions once again and am sure you will be able to see that these questions are just like any other questions and you can answer them very easily provided you are confident enough before the interviewing panel.

Always remember that your confidence during the interview day depends on how well you have prepared yourself. Don’t shift your focus to anything else but keep on internalizing the questions and answers and you will surely be proud of yourself at the end.

No comments:

Post a Comment

Feel free to comment, ask questions if you have any doubt.