Skip to content

Tracks Drills Topics Technologies Tech stacks Skill areas

Tracks Drills Topics

Loading

Aporeon

Technical interview practice, from one developer to another.

About Support Privacy Terms Refund policy

Java & Spring Backend

Spring Security & Testing

Security filter chains, authentication and authorization, unit and integration boundaries, test slices, and reliable test suites.

24 drillsPractice one at a timeOrdered pathConcept questionComparison questionArchitecture scenarioDebugging scenario

Recommended start

Spring Security request flow

Traces a Servlet request through the security proxy, selected filter chain, authentication, context, authorization, and exception handling.

Medium~7 minStep 1 of 24

Practice this drill Choose another

Search

24 of 24 shown

1Spring Security request flowRecommended startTraces a Servlet request through the security proxy, selected filter chain, authentication, context, authorization, and exception handling.Concept questionMedium~7 minJavaSpring BootPractice 2

Practice order

24 drillsOne at a time

1Spring Security request flowUp next / Medium / ~7 min
2Multiple security filter chainsHard / ~10 min
3Spring authentication componentsMedium / ~7 min

Multiple security filter chainsExplains first-match chain selection, rule matching inside a chain, ordering, fallback coverage, and accidental unprotected paths.Concept questionHard~10 minJavaSpring Boot

Practice

3Spring authentication componentsSeparates authentication orchestration, mechanism-specific verification, and username-based user lookup.Concept questionMedium~7 minJavaSpring BootPractice

4SecurityContext and principalExplains the request identity model, principal and authorities, default thread-local storage, cleanup, and asynchronous boundaries.Concept questionMedium~7 minJavaSpring BootPractice

5Authentication vs authorizationSeparates proving an identity from deciding whether that identity may perform a specific action on a resource.Comparison questionEasy~5 minJavaSpring BootPractice

6Roles, authorities, and scopesTreats GrantedAuthority as the common representation while explaining role prefixes, scope mapping, and domain permission design.Comparison questionMedium~7 minJavaSpring BootPractice

7Request vs method securityUses HTTP rules for route-level policy and method security for reusable service operations without creating contradictory enforcement.Comparison questionHard~10 minJavaSpring BootPractice

8Sessions vs bearer tokensChooses credential transport and server state from client shape, revocation, browser threats, scaling, and operational requirements.Comparison questionHard~10 minJavaSpring BootPractice

9Validate JWT resource serverUses Resource Server and JwtDecoder to validate signature, issuer, audience, time, algorithms, key rotation, and authority mapping.Architecture scenarioHard~10 minJavaSpring BootPractice

10Spring password storageStores salted adaptive password hashes, supports algorithm migration, and separates password verification from encryption.Concept questionMedium~7 minJavaSpring BootPractice

11Spring Security CSRFBases CSRF policy on whether browsers automatically attach credentials and keeps unsafe requests protected without disabling security globally.Architecture scenarioHard~10 minJavaSpring BootPractice

12Spring Security 401 vs 403Separates authentication challenge from denied authorization and traces the selected entry point, denied handler, and matched rule.Debugging scenarioMedium~7 minJavaSpring BootPractice

13Spring OAuth2 application rolesSeparates logging a user into an application, obtaining tokens for outbound calls, and validating access tokens on an API.Comparison questionHard~10 minJavaSpring BootPractice

14Choose a Spring test scopeSelects the smallest Spring test scope that can prove the risky boundary without mocking away framework or infrastructure behavior.Architecture scenarioMedium~7 minJavaSpring BootPractice

15Unit-test a Spring serviceConstructs a service directly with explicit collaborators and verifies behavior without Spring startup or framework-owned concerns.Architecture scenarioEasy~5 minJavaSpring BootPractice

16WebMvcTest vs SpringBootTestChooses a focused MVC slice or full application context based on whether the risk is the web contract or complete wiring.Comparison questionMedium~7 minJavaSpring BootPractice

17MockMvc vs real HTTPSeparates full Spring MVC dispatch over mock Servlet objects from tests that cross an actual network and container boundary.Comparison questionMedium~7 minJavaSpring BootPractice

18DataJpaTest boundariesUses the JPA slice for mappings and repositories while recognizing embedded-database substitutions and transaction-owned blind spots.Architecture scenarioHard~10 minJavaSpring BootPractice

19Spring Boot TestcontainersRuns stable shared production-like dependencies with Spring service connections, real migrations, deterministic data, and bounded startup cost.Architecture scenarioHard~10 minJavaSpring BootPractice

20Transactional test pitfallsFinds failures hidden by test-owned transactions, automatic rollback, open persistence contexts, missing flushes, and separate server threads.Debugging scenarioHard~10 minJavaSpring BootPractice

21Spring test context cachingImproves suite speed by reusing stable application contexts and avoiding configuration variation, unnecessary dirtiness, and process forks.Debugging scenarioHard~10 minJavaSpring BootPractice

22Mock Spring beans carefullyOverrides unstable external boundaries intentionally while keeping the framework behavior and real collaborators the test claims to prove.Architecture scenarioMedium~7 minJavaSpring BootPractice

23Test Spring HTTP clientsTests serialization, headers, status mapping, timeouts, and retries against a controllable HTTP boundary instead of mocking fluent internals.Architecture scenarioHard~10 minJavaSpring BootPractice

24Test Spring Security rulesTests anonymous, authenticated, forbidden, CSRF, JWT, method, ownership, and full credential flows without confusing mocked identity with authentication.Architecture scenarioHard~10 minJavaSpring BootPractice

4SecurityContext and principal

Medium / ~7 min

5Authentication vs authorizationEasy / ~5 min

6Roles, authorities, and scopesMedium / ~7 min

7Request vs method securityHard / ~10 min

8Sessions vs bearer tokensHard / ~10 min

+16 more drills in this section

Spring Security & Testing - Java & Spring Backend | Aporeon