Senior Quiz: Spring Security Internals¶

FilterChainProxy selects the first matching chain; it does not merge chains. A production test must prove /api/admin/** cannot be captured by a broader permissive chain. Method security is defense in depth, not a reason to leave the request boundary exposed.

The caller has an identity, so the failure is authorization and normally maps to 403. A 401 means authentication is absent or invalid. Browser and API error behavior may differ, but neither should leak policy internals.

ExceptionTranslationFilter handles authentication and authorization failures at the security boundary. Stable API JSON belongs in the entry point and denied handler; controller advice remains useful for failures raised inside controller/business execution.

CSRF depends on ambient credentials, not response format. HttpOnly prevents JavaScript from reading a cookie but does not stop the browser sending it. CORS is not a universal CSRF substitute and simple requests may not preflight.

Origins are browser execution boundaries, not identities. Never convert an origin allow list into a user or workload authorization decision.

Session fixation lets an attacker pre-seed an identifier and inherit the authenticated session. HttpOnly prevents script access but does not rotate or invalidate anything.

CSRF depends on ambient credentials, so protection follows the authentication style rather than the whole application. Chain-scoped configuration avoids weakening one flow to satisfy the other.

Wildcards are invalid with credentials, and reflecting the request origin defeats the boundary entirely. CORS also never replaces a CSRF token for cookie-authenticated state changes.

Proxy-based method security requires invocation through the proxied bean. Refactor the protected operation to a separate bean or use an appropriate interception strategy, then test calls through the real boundary.

Password hashes should not be decryptable. Migration normally verifies with the old encoder, then hashes the supplied password with the current encoder after successful authentication.

Invalid presented credentials should have an intentional failure path. Public routes may continue, but protected routes need a stable error contract, safe diagnostics, and unambiguous filter ownership.

hasRole normally applies the ROLE_ prefix. Use hasAuthority for exact values and normalize authority mapping at one trusted boundary.

Token issuance must be downstream of successful authentication. Spring's manager selects the supporting provider, while authorities come from trusted server-side identity data. Uniform public failures reduce account enumeration.

DelegatingPasswordEncoder makes the old format explicit. Silent unprefixed fallback hides corrupt or plaintext records. Migration must never occur after a failed match, and production updates need concurrency and audit handling without logging secrets.