Securing a Spring MVC application means defending it across several layers at once — verifying who a user is, controlling what they can access, and protecting the app from common web attack vectors.
Key Points: • Authentication confirms user identity, while authorization decides what an authenticated user is allowed to do — both need correct configuration to avoid gaps. • Cross-site scripting (XSS) and cross-site request forgery (CSRF) require input sanitization, output encoding, and CSRF tokens on state-changing requests. • All traffic should run over HTTPS, and sensitive data at rest should be encrypted rather than stored in plain text. • Session fixation, session hijacking, and insecure cookie flags are frequent oversights that need explicit session management configuration. • SQL injection is mitigated by using parameterized queries or an ORM rather than string-concatenated SQL. • Dependencies and security configuration need regular updates, since new CVEs surface continuously in frameworks and libraries.
Example: A team might correctly implement login and roles but forget to enable CSRF protection on a "delete account" form, letting an attacker trick a logged-in user's browser into submitting that request from a malicious site — a reminder that authentication alone isn't enough.
Interview Tip: A concise interview answer is:
"The main challenges are getting authentication and authorization right, defending against XSS and CSRF, enforcing HTTPS and encryption for sensitive data, and keeping sessions and cookies secure. On top of that, SQL injection prevention and staying current with dependency patches are ongoing concerns rather than one-time setup steps."