Top 25 Spring Boot Interview Questions and Answers – Part 4 (Spring Security, JWT, Validation & Actuator)
Introduction :
In the previous part, we covered Spring Data JPA and Hibernate interview questions, including repositories, entity relationships, transactions, cascading, and fetch strategies.
In this part, we'll explore Spring Security, JWT authentication, validation, exception handling, logging, and Spring Boot Actuator. These topics are essential for building secure and production-ready Spring Boot applications and are frequently asked in Java Full Stack and Spring Boot interviews.
36. What is Spring Security?
Answer:
Spring Security is a powerful authentication and authorization framework for Java applications. It protects applications from unauthorized access and common security vulnerabilities.
Features
- Authentication
- Authorization
- Password encryption
- CSRF protection
- CORS support
- Session management
- JWT and OAuth2 integration
37. What is Authentication?
Answer:
Authentication is the process of verifying the identity of a user.
Example:
A user enters a username and password. If the credentials are correct, the user is authenticated.
38. What is Authorization?
Answer:
Authorization determines what an authenticated user is allowed to access.
Example:
- Admin → Create, Update, Delete
- User → View only
Authentication happens first, followed by authorization.
39. What is the difference between Authentication and Authorization?
| Authentication | Authorization |
|---|---|
| Verifies user identity | Determines user permissions |
| Happens first | Happens after authentication |
| Checks credentials | Checks roles and privileges |
| Example: Login | Example: Accessing Admin APIs |
40. What is Spring Security Filter Chain?
Answer:
Spring Security processes every incoming HTTP request through a chain of security filters before it reaches the controller.
Common filters include:
- UsernamePasswordAuthenticationFilter
- BasicAuthenticationFilter
- JwtAuthenticationFilter
- ExceptionTranslationFilter
The filter chain ensures requests are authenticated and authorized.
41. What is JWT?
Answer:
JWT (JSON Web Token) is a compact, secure token used for stateless authentication between a client and server.
A JWT contains:
- Header
- Payload
- Signature
Example:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
42. Explain the structure of a JWT.
Answer:
A JWT consists of three parts:
Header
Contains the algorithm and token type.
{
"alg":"HS256",
"typ":"JWT"
}
Payload
Contains user information and claims.
{
"username":"john",
"role":"ADMIN"
}
Signature
Ensures the token has not been modified.
43. How does JWT Authentication work?
Answer:
Flow:
- User logs in with credentials.
- Server validates credentials.
- Server generates a JWT.
- Client stores the token.
- Client sends the token in the Authorization header.
- Server validates the token.
- Request is processed if the token is valid.
44. Session-Based Authentication vs JWT Authentication
| Session Authentication | JWT Authentication |
|---|---|
| Server stores session | Client stores token |
| Stateful | Stateless |
| More server memory | Better scalability |
| Suitable for web apps | Ideal for REST APIs |
45. What is OAuth 2.0?
Answer:
OAuth 2.0 is an authorization framework that allows users to grant third-party applications limited access to their resources without sharing passwords.
Example:
- Login with Google
- Login with GitHub
- Login with Facebook
46. What is CORS?
Answer:
CORS (Cross-Origin Resource Sharing) allows web applications from one domain to access resources from another domain securely.
Example:
Frontend:
http://localhost:3000
Backend:
http://localhost:8080
Spring Boot uses @CrossOrigin or global CORS configuration to allow cross-origin requests.
47. How do you secure REST APIs in Spring Boot?
Answer:
Common approaches include:
- Spring Security
- JWT Authentication
- OAuth2
- HTTPS
- Role-based access control
- Password encryption using BCrypt
48. What is @Valid?
Answer:
@Valid is used to validate request objects automatically before processing.
Example:
public ResponseEntity<User> saveUser(@Valid @RequestBody UserDto dto)
49. What is the difference between @Valid and @Validated?
| @Valid | @Validated |
|---|---|
| Standard Bean Validation | Spring-specific validation |
| Supports nested validation | Supports validation groups |
| Used for simple validation | Used for advanced validation |
50. Common Validation Annotations
Some frequently used validation annotations include:
-
@NotNull -
@NotBlank -
@NotEmpty -
@Email -
@Size -
@Min -
@Max -
@Pattern -
@Positive
51. What is MethodArgumentNotValidException?
Answer:
This exception occurs when request validation fails while using @Valid.
Spring throws this exception automatically, and it is commonly handled using global exception handling.
52. What is @ControllerAdvice?
Answer:
@ControllerAdvice provides centralized exception handling across all controllers.
It helps eliminate duplicate try-catch blocks and keeps the code clean.
53. What is @ExceptionHandler?
Answer:
@ExceptionHandler handles specific exceptions thrown by controllers.
Example:
@ExceptionHandler(ResourceNotFoundException.class)
54. How do you implement Global Exception Handling?
Answer:
Create a class annotated with @ControllerAdvice and define methods using @ExceptionHandler to return meaningful error responses.
Benefits:
- Consistent API responses
- Cleaner controllers
- Centralized error handling
55. How is Logging implemented in Spring Boot?
Answer:
Spring Boot uses SLF4J with Logback as the default logging framework.
Example:
private static final Logger logger =
LoggerFactory.getLogger(UserService.class);
logger.info("User created successfully");
56. What are the logging levels?
Answer:
Common logging levels are:
- TRACE
- DEBUG
- INFO
- WARN
- ERROR
Production applications generally use INFO, WARN, and ERROR.
57. What is Spring Boot Actuator?
Answer:
Spring Boot Actuator provides production-ready features to monitor and manage applications.
It exposes endpoints for:
- Health
- Metrics
- Beans
- Environment
- Logging
- Thread dumps
58. What are some commonly used Actuator endpoints?
| Endpoint | Purpose |
|---|---|
/actuator/health | Application health |
/actuator/info | Application information |
/actuator/metrics | Performance metrics |
/actuator/env | Environment properties |
/actuator/beans | Spring Beans |
/actuator/loggers | Logger configuration |
59. How do you expose Actuator endpoints?
Answer:
Configure them in application.properties:
management.endpoints.web.exposure.include=*
In production, expose only the required endpoints for security reasons.
60. What are the best practices for securing Spring Boot applications?
Answer:
Some recommended best practices include:
- Use Spring Security.
- Encrypt passwords using BCrypt.
- Prefer JWT or OAuth2 for authentication.
- Enable HTTPS.
- Validate all user inputs.
- Implement global exception handling.
- Use role-based access control.
- Keep dependencies updated.
- Disable unnecessary Actuator endpoints in production.
- Never hardcode secrets; use environment variables or secure configuration management.
Conclusion :
In Part 4, we explored advanced Spring Boot interview questions covering Spring Security, JWT authentication, validation, global exception handling, logging, and Spring Boot Actuator. These topics are essential for building secure, reliable, and production-ready enterprise applications and are frequently discussed in experienced Java developer interviews.
In Part 5, we'll cover Spring Boot Microservices, REST API Best Practices, API Versioning, Resilience Patterns, Docker, Kubernetes, and Cloud deployment concepts—key topics for modern enterprise application development and advanced technical interviews.
Happy Learning! 🚀
Comments
Post a Comment