Spring Security Interview Question

public key

1. Publicly shared encryption key
2. Encrypts sensitive data
3. Verifies digital signatures
4. Paired with private key
5. Cannot decrypt private data

private key

1. Secret cryptographic key
2. Decrypts encrypted data
3. Creates digital signatures
4. Paired with public key
5. Must remain confidential

certificate

1. Verifies entity identity
2. Contains public key
3. Issued by Certificate Authority
4. Enables secure communication
5. Used in SSL/TLS

pkcs file

1. Stores cryptographic keys securely
2. Contains certificates and keys
3. Password-protected file format
4. Commonly uses .p12
5. Used for SSL/TLS

pem file

1. Base64-encoded text format
2. Stores certificates or keys
3. Uses ASCII encoding
4. Begins with BEGIN header
5. Commonly used for SSL

cacerts

1. JVM trusted certificates store
2. Contains CA certificates
3. Validates SSL/TLS connections
4. Used by HTTPS clients
5. Managed using keytool

cookie

1. Stored in browser
2. Maintains user session
3. Sent with requests
4. Can store small data
5. Supports authentication state

session

1. Stores user-specific state
2. Maintained on server
3. Identified using session ID
4. Persists across requests
5. Expires after inactivity

JWT

Stateless authentication mechanism

Contains signed user claims

Validated by security filter

No server-side session

Secures protected API endpoints

 Spring Cloud Gateway

1. Centralized API authentication
2. Validates JWT tokens
3. Applies authorization rules
4. Routes secured requests
5. Protects downstream services

@PreAuthorize

1. Method-level security annotation
2. Checks access before execution
3. Uses SpEL expressions
4. Supports roles and permissions
5. Blocks unauthorized access

claims

1. JWT payload information
2. Contains user identity
3. Includes roles and permissions
4. Digitally signed data
5. Used for authorization

principal

1. Represents authenticated user
2. Contains user identity
3. Available in SecurityContext
4. Used for authorization
5. Retrieved after authentication

session

1. Stores client session state

2. Maintained on server side

3. Identified using session ID

4. Uses HttpSession API

5. Supports login session management

   cookie

   1. Stores data in browser

   2. Sent with HTTP requests

   3. Can maintain session state

   4. Supports secure authentication cookies

   5. Configured using cookie attributes

   session Id 

   1. Uniquely identifies user session

   2. Usually stored in cookie

   3. Maps client to server

   4. Generated when session created

   5. Should be unpredictable and secure

What is the difference between DelegatingFilterProxy and FilterChainProxy in Spring Security?

• DelegatingFilterProxy: A standard Servlet filter registered in the traditional web.xml or Servlet container context. It does not perform security checks itself. Instead, it bridges the gap by delegating the filter workload to a Spring-managed bean.
• FilterChainProxy: The actual Spring-managed bean that wraps the SecurityFilterChain. It orchestrates the sequence of custom and predefined security filters (JwtAuthenticationFilter, UsernamePasswordAuthenticationFilter, etc.)

How do you protect a Java application against SQL Injection (SQLi) and Cross-Site Scripting (XSS)?

• SQL Injection: Never concatenate input variables directly inside raw queries. Use PreparedStatementor robust Object-Relational Mappings (ORMs) like Hibernate/JPA. They separate query logic from data parameters using automated placeholder binding.
• XSS Mitigation: Treat all incoming data as untrusted. Use context-aware HTML/Javascript escaping via libraries like OWASP Java Encoder. Implement strict Content Security Policies (CSP) headers to stop unauthorized third-party scripts from executing inside your UI layer.