Prev Next

Spring / Spring gRPC Interview Questions

How would you restrict which gRPC methods a caller can access, i.e. authorization?

Authorization is typically implemented in a ServerInterceptor that runs after authentication has already populated the caller's identity (whether from a validated JWT or from an mTLS client certificate). The interceptor inspects the method being called (available from the call's descriptor) against the caller's roles or permissions, and rejects the call with Status.PERMISSION_DENIED if the check fails.

Unlike Spring Security's @PreAuthorize for REST controllers, there's no built-in method-level annotation for gRPC in vanilla Spring, so per-method authorization rules are usually expressed as explicit interceptor logic (e.g., a lookup table of service/method name to required role) rather than declarative annotations, unless a project adds its own custom annotation-processing layer for this.

Where is gRPC method-level authorization commonly enforced?
What status is typically returned when a gRPC authorization check fails?

More Related questions...

What is gRPC and why would you use it in a Spring application? How does gRPC differ from traditional REST APIs? What are the four types of service methods gRPC supports? What role does HTTP/2 play in gRPC? What is a.proto file and what is it used for? What is the role of the protoc compiler and code-generation plugins in a Spring project? What is a gRPC channel, and how does it differ from a single HTTP connection? What are gRPC status codes, and how do they compare to HTTP status codes? What are the advantages of Protocol Buffers over JSON for service payloads? Explain field numbering in a.proto message and why it matters? How does protobuf handle backward and forward compatibility? What is the difference between proto2 and proto3 syntax? What Java types do common protobuf scalar types map to? How do you handle optional vs unset primitive fields in proto3? What are the main ways to integrate gRPC into a Spring Boot application? What does the @GrpcService annotation do? How do you configure the gRPC server port in a Spring Boot app using the community starter? How do you create and inject a gRPC client stub in Spring? What is the difference between a blocking stub, a non-blocking async stub, and a future stub in generated gRPC client code? How does Spring's dependency injection interact with generated gRPC service classes? Can gRPC and Spring MVC or WebFlux REST endpoints run in the same application? How do you enable gRPC server reflection in Spring Boot, and why would you? How would you expose actuator-style health checks for a gRPC service? How do you handle configuration for multiple gRPC clients pointing to different backend services? How do you implement a server-streaming RPC in a Spring @GrpcService? How do you implement a bidirectional streaming RPC? What thread-safety considerations apply to StreamObserver in gRPC? How does backpressure work in gRPC streaming, and how would you handle a slow consumer? When would you choose client streaming over unary calls in a Spring service? How would you test streaming gRPC endpoints in a Spring Boot integration test? What is a ServerInterceptor in gRPC, and what is it typically used for? How do you propagate contextual data such as a request ID or authenticated user through a gRPC call in Spring? How should errors be communicated back to the client in gRPC, and how does this differ from throwing a plain exception? How do you implement centralized exception handling for gRPC services in Spring, analogous to @ControllerAdvice for REST? What is gRPC Metadata, and how does it compare to HTTP headers? How would you implement deadline/timeout handling for gRPC calls from a Spring client? How do you enable TLS for a gRPC server in a Spring Boot application? How does authentication typically work in a gRPC plus Spring setup? What is mTLS and why is it commonly used for internal gRPC service-to-service communication? How would you restrict which gRPC methods a caller can access, i.e. authorization? How do you unit test a gRPC service implementation without starting a real server? What is the purpose of InProcessServerBuilder and InProcessChannelBuilder in gRPC testing? How would you write a Spring Boot integration test that spins up the embedded gRPC server? How do you assert on streaming responses in a test without blocking indefinitely? How does gRPC support client-side load balancing across multiple server instances? Why can gRPC load balancing be trickier in Kubernetes than for plain HTTP/1.1 services? What connection or channel pooling considerations apply when calling gRPC services from Spring? How would you monitor gRPC service performance in a Spring Boot application? When would you choose gRPC over REST for a new Spring microservice, and when would you stick with REST? What are some best practices for evolving gRPC service contracts in a Spring microservices system over time?
Show more question and Answers...

Hibernate

Comments & Discussions

Interviews Questions

About Javapedia.net

Javapedia.net is for Java and J2EE developers, technologist and college students who prepare of interview. Also this site includes many practical examples.

This site is developed using J2EE technologies by Steve Antony, a senior Developer/lead at one of the logistics based company.

Follow Javapedia updates

contact: javatutorials2016[at]gmail[dot]com

Kindly consider donating for maintaining this website. Thanks.

Copyright © 2026, javapedia.net, all rights reserved. · .

DMCA.com Protection Status