Prev Next

Spring / Spring7 Intermediate to Advanced Interview questions

What is the difference between Spring Security 6 and Spring Security 7?

Spring Security 7 (paired with Spring Framework 7) makes several changes that go beyond a routine dependency bump.

AspectSpring Security 6Spring Security 7
Multi-factor authNo first-class supportNative MFA authorization managers
OAuth2 password grantPresent, discouragedRemoved entirely
PKCE / dynamic registrationOpt-in on the Authorization ServerEnabled by default
Null safetySpring's own annotationsJSpecify
SAML2 / KerberosLegacy dependency chainsModernized, legacy deps removed

The MFA support is the headline feature - it was one of the most long-requested capabilities in the project's history - while the OAuth2 defaults changes reflect a broader push toward secure-by-default configuration rather than secure-if-configured-correctly.

Which long-requested feature became native in Spring Security 7?
What happened to the OAuth2 password grant in Spring Security 7?

More Related questions...

What is the difference between Spring Framework 6 and Spring Framework 7? How does Spring Boot 4 differ from Spring Boot 3 in terms of baseline requirements? Which is better and why: upgrading directly from Spring Boot 2 to Spring Boot 4, or upgrading incrementally through Spring Boot 3? Why did Spring Framework 7 move from Jakarta EE 10 to Jakarta EE 11? What happens when a Spring Boot 3 / Spring 6 application is upgraded to Spring Boot 4 / Spring 7 without addressing RestTemplate and other deprecations? What is the difference between Spring Security 6 and Spring Security 7? How does multi-factor authentication (MFA) work natively in Spring Security 7? Why was the OAuth2 password grant removed in Spring Security 7? How does Spring Security 7 improve OAuth2 client support for HTTP service clients like RestClient? When should you choose PKCE over the classic authorization code flow in Spring Security 7's Authorization Server? Explain the execution flow of a request through the Spring Security filter chain? How do you prevent duplicate form submissions caused by double-clicking a submit button in a Spring MVC application? How would you implement idempotency-key based duplicate request detection in a Spring REST API? Why is the Post/Redirect/Get pattern not sufficient on its own to prevent double-click duplicate submissions? Why doesn't @Transactional work when called from within the same class (self-invocation)? How does Spring resolve circular dependencies between singleton beans? Explain the internal working of the DispatcherServlet request-handling flow in Spring MVC? Explain the internal working of Spring AOP proxy creation? How is a GraalVM native image build different from a traditional JAR deployment in Spring Boot 4? When should you choose WebFlux over Spring MVC in a Spring Framework 7 application? How do you troubleshoot a bean that fails to initialize due to a circular dependency? What happens when two beans of the same type exist without a @Primary or @Qualifier? How can you optimize Spring Boot 4 application startup time? Why should you avoid field injection in production Spring codebases? How is the API version resolved when a client sends no version header in Spring Framework 7? Which is better and why: RestClient or WebClient for a blocking Spring MVC service? How does Spring Framework 7 take advantage of virtual threads compared to the traditional platform-thread model? Why doesn't a @Scheduled method run concurrently with itself by default in Spring? How do you troubleshoot a NoSuchBeanDefinitionException in a Spring application? Explain the lifecycle of a request handled through an HTTP Interface client (@HttpExchange) in Spring 7? What is the difference between @ControllerAdvice and a Filter for handling errors in Spring MVC? Why is JSpecify considered a breaking change for some Kotlin Spring projects upgrading to Spring Framework 7? How do you optimize a Spring Data JPA application to avoid the N+1 query problem? When would you choose NESTED over REQUIRES_NEW transaction propagation? How does Micrometer observability integrate with Spring Framework 7's tracing support? Why is @Order important when multiple Filters or HandlerInterceptors are registered in a Spring application? How does Spring Framework 7's BeanRegistrar differ from a traditional @Configuration class with multiple @Bean methods? What is the difference between @RequestMapping's version attribute and content negotiation via the Accept header for API evolution? How do you troubleshoot slow Spring Boot 4 native image builds? Why do many teams delay adopting GraalVM native images despite the startup-time benefits in Spring Boot 4?
Show more question and Answers...

Spring gRPC Interview Questions

Comments & Discussions

Interviews Questions

About Javapedia.net

Javapedia.net is for Java and J2EE developers, technologist and college students who prepare of interview. Also this site includes many practical examples.

This site is developed using J2EE technologies by Steve Antony, a senior Developer/lead at one of the logistics based company.

Follow Javapedia updates

contact: javatutorials2016[at]gmail[dot]com

Kindly consider donating for maintaining this website. Thanks.

Copyright © 2026, javapedia.net, all rights reserved. · .

DMCA.com Protection Status