Spring Boot offers several complementary mechanisms for securing a REST API, ranging from simple credential checks to full token-based authorization, all built on Spring Security's filter chain.
Key Points: • Basic Authentication sends credentials on every request—simple but only safe over HTTPS and rarely used beyond internal tools. • OAuth2 delegates authentication/authorization to an external provider, ideal for federated or third-party access. • JWT provides stateless, self-contained tokens well suited to microservices and horizontally scaled APIs. • Method-level security annotations (@PreAuthorize, @Secured) add fine-grained control beyond URL rules. • CORS configuration and enforced HTTPS/TLS round out the picture by controlling cross-origin access and encrypting traffic.
Example: A public-facing API uses OAuth2 with JWT bearer tokens for external clients, while an internal admin tool behind a VPN might get away with simpler Basic Authentication.
Interview Tip: A concise interview answer is:
"Spring Boot supports several options—Basic Authentication for simple cases, OAuth2 for delegated third-party access, and JWT for stateless token-based auth well suited to microservices. On top of whichever authentication method I pick, I'd layer method-level security, CORS rules, and enforced HTTPS for a complete setup."