Spring / Spring Security
1. What is Spring Security?
Spring Security provides comprehensive security services for Java EE-based enterprise software applications. There are two main areas that Spring Security targets....
2. What is Oauth?
OAuth is an open standard for authorization. OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner....
3. What is a security context?
Security context in Spring Security includes details of the principal currently using the application. Security context is always available to methods in the same thread of execution, even if the security context is not explicitly passed around as an argument...
4. What is security principal?
A principal is an identity: a user, account, or service the security runtime authenticated. In Spring Security it lives on the Authentication object.
5. How do I enable Spring Security in Java Web application?
To enable Spring security in Java Web application, you need to do configure three things, declare a delegating proxy filter in web.xml, add ContextLoaderListener in web.xml, and provide actual security constraints on applicationContext-Security.xml file. Since Spring security uses a chain...
6. Which filter class is required for spring security?
The DelegatingFilterProxy class from package org.springframework. web.filter is required.
7. Minimum java and spring version required for spring security?
8. Mention other filters in spring security and its purpose.
SecurityContextIntegrationFilter : establishes SecurityContext and maintains between HTTP requests. LogoutFilter : clears SecurityContextHolder when logout requested.
9. Types of authentication that spring supports.
HTTP Basic authentication, HTTP digest, Form based, Using LDAP, OAUTH, Automatic remember me authentication.
10. Explain BASIC authentication.
Basic authentication is a simple authentication scheme built into the HTTP protocol. The client sends HTTP requests with the Authorization header that contains the word Basic word followed by a space and a base64-encoded string username:password .
11. Explain digest authentication.
Digest authentication is an application of MD5 cryptographic hashing with usage of nonce values to prevent replay attacks. It uses the HTTP protocol.
12. Does Spring Security support password hashing?
Yes, Spring Security provides support for password hashing.
13. What is salting in spring security?
Salting secure your application from Dictionary-Attack. Using Salt you may add an extra string in password so hacker find it difficult for braking the password....
14. How to restrict static resources using spring security?
The Ant matchers match against the request path and not the path of the resource on the filesystem.So ignore any request that starts with "/resources/".This is similar to configuring http@security=none when using the XML namespace configuration. @Override public void configure(WebSecurity...
15. Is there a way to set up basic authentication and form login in same application?
Yes. We may need form login for web app and basic for rest services.
16. What is JCA in Java?
Java Cryptography Architecture implements security functions for the Java platform. It provides a platform and gives architecture and APIs for encryption and decryption....
17. Explain mutual authentication.
Mutual authentication, also called two-way authentication, is a process or technology in which both entities in a communications link authenticate each other.
18. Name an alternative to Spring security.
Apache Shiro is an open-source software security framework that performs authentication, authorization, cryptography and session management. Shiro is an intuitive and easy-to-use framework with robust security features.
19. Difference between OAuth 1 and OAuth 2.
Different OAuth Flows to allow better support for non-browser based applications. This is a main criticism against OAuth from client applications that were not browser based....
20. What is meant by Public Key Infrastructure (PKI)?
PKI refers to a collective ecosystem of roles, responsibilities, policies, and procedures for issuing, managing, and revoking digital certificates. The PKI ecosystem ensures the secure and private exchange of sensitive electronic information between known and unknown parties over untrusted networ
21. How Java supports PKI Model?
The Java platform provides many features to support the PKI model and trust management for Java. Oracle's root certificate program: Organizations that wish to include a root within the JDK's trust store apply to the program....
22. What is DelegatingFilterProxy in Spring Security?
DelegatingFilterProxy is the entry point of Spring Security in a Java web application. It is a generic bean that provides a link between web.xml and application-Context.xml....
23. Difference between spring security and oauth2.
Spring Security is a comprehensive Java framework for providing authentication and authorization in applications, while OAuth 2.0 is an industry-standard authorization protocol. The key difference is that Spring Security is an implementation tool, and OAuth 2.0 is a set of...
24. Difference between Spring Security 5 and 6.
Spring Security 6 (shipped with Spring Boot 3) represents a significant modernization of the framework, removing long-deprecated APIs and enforcing more secure defaults. Note: Most changes in version 6 are designed to support Jakarta EE 9/10 and Java 17+ ....
