Spring / Spring Security
1. What is Spring Security?
Spring Security provides comprehensive security services for Java EE-based enterprise software applications. There are two main areas that Spring Security targets. "Authentication" is the process of establishing a principal is who they claim to be (a "principal" generally means a user, device or ...
2. What is Oauth?
OAuth is an open standard for authorization. OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. It specifies a process for resource owners to authorize third-party access to their server resources without sharing their credentials.
3. What is a security context?
Security context in Spring Security includes details of the principal currently using the application. Security context is always available to methods in the same thread of execution, even if the security context is not explicitly passed around as an argument to those methods.
4. What is security principal?
SecurityContextHolder stores the principal currently interacting with the application. The principal is the currently logged in user that you retrieve it through the security context. Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); if (principal instanceo...
5. How do I enable Spring Security in Java Web application?
To enable Spring security in Java Web application, you need to do configure three things, declare a delegating proxy filter in web.xml, add ContextLoaderListener in web.xml, and provide actual security constraints on applicationContext-Security.xml file. Since Spring security uses a chain of filt...
6. Which filter class is required for spring security?
The DelegatingFilterProxy class from package org.springframework. web.filter is required.
7. Minimum java and spring version required for spring security?
8. Mention other filters in spring security and its purpose.
SecurityContextIntegrationFilter : establishes SecurityContext and maintains between HTTP requests. LogoutFilter : clears SecurityContextHolder when logout requested. UsernamePasswordAuthenticationFilter : places Authentication into the SecurityContext on login request. ExceptionTranslationFilter...
9. Types of authentication that spring supports.
HTTP Basic authentication, HTTP digest, Form based, Using LDAP, OAUTH, Automatic remember me authentication.
10. Explain BASIC authentication.
Basic authentication is a simple authentication scheme built into the HTTP protocol. The client sends HTTP requests with the Authorization header that contains the word Basic word followed by a space and a base64-encoded string username:password .
11. Explain digest authentication.
Digest authentication is an application of MD5 cryptographic hashing with usage of nonce values to prevent replay attacks. It uses the HTTP protocol.
12. Does Spring Security support password hashing?
Yes, Spring Security provides support for password hashing.
13. What is salting in spring security?
Salting secure your application from Dictionary-Attack. Using Salt you may add an extra string in password so hacker find it difficult for braking the password. There are 2 salt methods, Global Salt. Per User Salt. In Global Salt there is one single common word append to password. In Per User Sal...
14. How to restrict static resources using spring security?
The Ant matchers match against the request path and not the path of the resource on the filesystem.So ignore any request that starts with "/resources/".This is similar to configuring http@security=none when using the XML namespace configuration. @Override public void configure(WebSecurity web) th...
15. Is there a way to set up basic authentication and form login in same application?
Yes. We may need form login for web app and basic for rest services. In that case multiple http configuration is required.
16. What is JCA in Java?
Java Cryptography Architecture implements security functions for the Java platform. It provides a platform and gives architecture and APIs for encryption and decryption. JCA is used by the developer to combine the application with the security measure. A programmer uses the JCA to meet the securi...
17. Explain mutual authentication.
Mutual authentication, also called two-way authentication, is a process or technology in which both entities in a communications link authenticate each other.
18. Name an alternative to Spring security.
Apache Shiro is an open-source software security framework that performs authentication, authorization, cryptography and session management. Shiro is an intuitive and easy-to-use framework with robust security features.
19. Difference between OAuth 1 and OAuth 2.
Different OAuth Flows to allow better support for non-browser based applications. This is a main criticism against OAuth from client applications that were not browser based. For example, in OAuth 1.0, desktop applications or mobile phone applications had to direct the user to open their browser ...
20. What is meant by Public Key Infrastructure (PKI)?
PKI refers to a collective ecosystem of roles, responsibilities, policies, and procedures for issuing, managing, and revoking digital certificates. The PKI ecosystem ensures the secure and private exchange of sensitive electronic information between known and unknown parties over untrusted networ...
21. How Java supports PKI Model?
The Java platform provides many features to support the PKI model and trust management for Java. Oracle's root certificate program: Organizations that wish to include a root within the JDK's trust store apply to the program. if the requester meets the qualifications and agrees to the terms. the r...
22. What is DelegatingFilterProxy in Spring Security?
DelegatingFilterProxy is the entry point of Spring Security in a Java web application. It is a generic bean that provides a link between web.xml and application-Context.xml. Spring security uses filters to implement cross-cutting concerns like authentication and authorization. In Spring security,...
23. Difference between spring security and oauth2.
Spring Security is a comprehensive Java framework for providing authentication and authorization in applications, while OAuth 2.0 is an industry-standard authorization protocol. The key difference is that Spring Security is an implementation tool, and OAuth 2.0 is a set of rules/specifications it...
24. Difference between Spring Security 5 and 6.
Spring Security 6 (shipped with Spring Boot 3) represents a significant modernization of the framework, removing long-deprecated APIs and enforcing more secure defaults. Note: Most changes in version 6 are designed to support Jakarta EE 9/10 and Java 17+ . 1. Fundamental Baseline Changes Java Ver...
