Spring Security

1. Do you need to use Spring in your Servlet-based application to take advantage of Spring Security ?

No.

Spring Security

2. How does Spring Security integrate with the Servlet Container?

Spring Security integrates with the Servlet Container by using a standard Servlet Filter.

Spring Security

3. Does Spring Security work with any application that runs in a Servlet Container?

Yes.


Spring Security

4. Spring Boot adds any Filter bean to the application filter chain.

Spring Security

5. Types of Servlet Container?

Apache Tomcat, Jetty, IBM WebSphere.

Spring Security

6. Spring Boot Security Auto Configuration?

  • Adds @EnableWebSecurity
  • Creates a @Bean UserDetailsService
  • Creates a @Bean AuthenticationEventPublisher


Spring Security

7. DelegatingFilterProxy

You can register “DelegatingFilterProxy” through the standard Servlet container mechanism but delegate all the work to a Spring Bean that implements “Filter”.

Spring Security

8. FilterChainProxy

FilterChainProxy is a special Filter provided by Spring Security that allows delegating to many Filter instances through SecurityFilterChain.

Spring Security

9. SecurityFilterChain is used by FilterChainProxy to determine which Spring Security Filter instances should be invoked for the current request.


Spring Security

10. How are Filter instances invoked in a Servlet container?

In a Servlet container, Filter instances are invoked based upon the URL alone.

Spring Security

11. FilterChainProxy can determine invocation based upon anything in the HttpServletRequest by using RequestMatcher interface.

Spring Security

12. There could be multiple SecurityFilterChain from which FilterChainProxy could choose.


Spring Security

13. How can you see the order of Filters

By using FilterOrderRegistration you can see the order.

Spring Security

14. HttpSecurity can register Security Filters and build a SecurityFilterChain.

Spring Security

15. The list of filters is printed at INFO level on the application startup.


Spring Security

16. Instead of implementing Filter interface, you can extend from OncePerRequestFilter.

Spring Security

17. How to add a custom Filter to the chain?

  • Implement Filter interface of extend OncePerRequestFilter class
  • Add it to the chain with HttpSecurity.addFilter*() methods.

Spring Security

18. Do not declare your Filter as a @Bean if you already add it with HttpSecurity to the chain, because it will be registered twice and thus invoked twice.


Spring Security

19. The ExceptionTranslationFilter allows translation of AccessDeniedException and AuthenticationException into Http responses.

Spring Security

20. Saving Requests between Authentication is done using RequestCache.

Spring Security

21. The RequestCacheAwareFilter is what uses the RequestCache to save the HttpServletRequest.


Spring Security

22. Prevent the request from being saved with NullRequestCache.

Spring Security

23. Spring Security does not add any detail of why a request has been rejected to the response body.