Spring Security · interview question
Why is role=CUSTOMER in a valid JWT often insufficient to authorize GET /orders/123?
Multiple choiceMediumchapter-17-curatedpremiumspring-securityauthorization
Answer and explanation
Correct answer
A. The system may still need ownership, workflow-state, or tenant checks for that specific order
Why
Authorization often depends on more than a coarse role. A customer can be authenticated yet still be forbidden from reading someone else's order or refunding an order in the wrong state.
Test yourself on Spring Security
A free test with instant, explained results. No account needed.
More Spring Security questions
- Which of the following best describes the purpose of the Spring Security Filter Chain?
- Why does the CSRF token in Spring Security matter in this design?
- In Spring Security, what role does the SecurityContextHolder play in handling authentication?
- Which Spring Security filter is responsible for handling CORS preflight requests?
- Why do teams use a stateless authentication mechanism such as JWT in Spring Security in production code?
- Which component of the Spring Security Filter Chain is responsible for preventing unauthorized access to protected…