You need to secure a Spring Boot application to ensure that only authenticated users can access certain endpoints. Describe how you would configure Spring Security to set up a basic form-based authentication.

Question

Accepted Answer

Spring Security provides form-based authentication to verify user identity before allowing access to protected resources. Users are redirected to a login page where they provide credentials, and only authenticated users can access secured endpoints.

Key Points:
• Spring Security automatically provides a default login page when form login is enabled.
• URL-based authorization rules determine which endpoints require authentication.
• User details can be stored in-memory, in a database, or loaded from external identity providers.

Example:
Consider an Employee Portal application.

Public Endpoints:
• /login
• /about
• /contact

Protected Endpoints:
• /dashboard
• /profile
• /admin

Flow:

User Requests /dashboard
          ↓
Spring Security Intercepts Request
          ↓
Redirect to Login Page
          ↓
User Enters Credentials
          ↓
Authentication Successful
          ↓
Access Granted

Code Example:

```
@Configuration
@EnableWebSecurity
public class SecurityConfig {

@Bean
    public SecurityFilterChain securityFilterChain(
            HttpSecurity http) throws Exception {

http
```
            .authorizeHttpRequests(auth -> auth
```
                .requestMatchers(
                    "/login",
```
                    "/about").permitAll()
                .requestMatchers(
                    "/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
```
            );

return http.build();
    }
}
```
User Configuration Example:

```
@Bean
public UserDetailsService userDetailsService() {
```
    UserDetails user = User.builder()
            .username("admin")
            .password(
                passwordEncoder().encode("admin123"))
            .roles("ADMIN")
```
            .build();

return new InMemoryUserDetailsManager(user);
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}
```
Authentication Options:

• In-Memory Authentication
• Database Authentication
• LDAP Authentication
• OAuth2 Authentication
• JWT Authentication

Security Best Practices:

• Always store passwords using BCryptPasswordEncoder.
• Use HTTPS for secure communication.
• Implement role-based access control.
• Disable unnecessary endpoints.
• Enable CSRF protection for web applications.

Real-World Example:

Banking Application:

Public:
• Login Page
• Registration Page

Authenticated Users:
• Account Details
• Fund Transfer
• Transaction History

Administrators:
• User Management
• Audit Reports

Interview Tip:
A concise interview answer is: To configure basic form-based authentication in Spring Boot, I would add the Spring Security dependency, configure a SecurityFilterChain to protect endpoints, enable formLogin() for login handling, and configure users either in-memory or through a database using UserDetailsService. Passwords should always be stored using BCryptPasswordEncoder for security.