Role-Based Access Control in Spring Boot – Java Fresher Interview
Fast recall
Quick revision
Core answer
Interview-ready guide
Interview answer
RBAC means permissions belong to roles and users or service accounts receive those roles. For example, an ADMIN role may allow user management while a REPORT_VIEWER role may only read reports. This is easier to manage than checking individual user names throughout the code.
Spring Security represents these values as GrantedAuthority objects. With the default configuration, hasRole("ADMIN") checks for ROLE_ADMIN, while hasAuthority("READ_REPORT") checks that exact string. The ROLE_ prefix can be customized, so the database model should follow the application's chosen mapping rather than assuming the prefix is universal.
I can apply coarse rules in SecurityFilterChain and use @PreAuthorize or an authorization service for resource-specific rules such as tenant membership or order ownership. Method annotations require @EnableMethodSecurity.
Role-Based Access Control in Spring Boot – Java Fresher Interview
Direct Answer
Role-Based Access Control assigns permissions to roles and assigns users or service accounts to those roles. In Spring Security, roles are represented as GrantedAuthority values. hasRole("ADMIN") looks for ROLE_ADMIN by default, while hasAuthority("READ_REPORT") matches the exact value. ROLE_ is a configurable default prefix, not a mandatory database format. Enforce coarse request rules and resource-specific ownership or permission rules at the boundary that owns them.
Common Mistakes & Pitfalls
- Assuming ROLE_ is an unchangeable storage rule; it is the default prefix used by role helpers and can be configured.
- Passing ROLE_ADMIN to hasRole while the default prefix is active, which asks for ROLE_ROLE_ADMIN.
- Hard-coding user names instead of assigning roles or permissions.
- Using only a broad role when the real rule also requires tenant or resource ownership.
- Treating a final authenticated() matcher as “deny by default”; it permits every remaining authenticated request, so explicit denyAll may be appropriate.
Check your understanding
Answer these without looking back at the article.
- What's the difference between a role and a fine-grained authority?
- Why does Spring's hasRole add a ROLE_ prefix automatically?
- How do you enforce RBAC at both the URL and method level?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.