REST APIs, Security and Microservices Interview Questions for Java Full Stack with React

Show answer

REST treats everything as a resource identified by a URL, such as /api/orders/42, and uses standard HTTP methods to act on it. Requests are stateless, so each one carries all the information needed, including the auth token. Responses use proper status codes and representations, usually JSON, and can be cacheable. Good REST design uses nouns in URLs, plural resource names, nested paths for relations and query parameters for filtering and pagination.

Which HTTP methods are safe and which are idempotent?

Show answer

Safe methods do not change server state: GET, HEAD and OPTIONS. Idempotent methods give the same result if repeated: GET, PUT, DELETE, HEAD and OPTIONS. POST is neither, so retrying a POST can create duplicate orders, which is why payment APIs use an idempotency key header. PATCH is not guaranteed idempotent. Knowing this matters for retries in clients, gateways and message consumers.

Explain the common HTTP status codes a REST API should return.

Show answer

200 OK for successful reads and updates, 201 Created with a Location header after creating a resource, and 204 No Content for successful deletes. 400 Bad Request for validation errors, 401 Unauthorized when authentication is missing or invalid, 403 Forbidden when the user is authenticated but not allowed, 404 Not Found, 409 Conflict for version or duplicate conflicts, and 429 Too Many Requests for rate limits. 500 means an unexpected server error and 503 means temporarily unavailable.

What is the difference between authentication and authorization?

Show answer

Authentication verifies who the user is, for example by checking a password, OTP or token. Authorization decides what that authenticated user is allowed to do, for example only admins can delete products. In Spring Security, authentication produces an Authentication object with granted authorities, and authorization uses those authorities in URL rules or annotations like @PreAuthorize("hasRole('ADMIN')"). A failed authentication gives 401 and a failed authorization gives 403.

Write a basic CRUD REST controller in Spring Boot.

Show answer

@RestController @RequestMapping("/api/products") public class ProductController { private final ProductService service; public ProductController(ProductService service) { this.service = service; } @GetMapping("/{id}") public ProductDto get(@PathVariable Long id) { return service.get(id); } @PostMapping public ResponseEntity<ProductDto> create(@Valid @RequestBody ProductRequest req) { ProductDto saved = service.create(req); return ResponseEntity.created(URI.create("/api/products/" + saved.id())).body(saved); } @DeleteMapping("/{id}") @ResponseStatus(HttpStatus.NO_CONTENT) public void delete(@PathVariable Long id) { service.delete(id); } }

How do you store user passwords securely in Spring Boot? Show the code.

Show answer

@Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); } public void register(RegisterRequest req) { User user = new User(req.email(), encoder.encode(req.password())); userRepository.save(user); } public boolean checkLogin(String raw, User user) { return encoder.matches(raw, user.getPasswordHash()); } // BCrypt adds a random salt and is deliberately slow. // Never store plain text or use MD5/SHA-1 for passwords.

How do you work with frontend developers and testers on API changes?

Show answer

I agree on the API contract first using an OpenAPI spec or Swagger UI, so frontend and QA can start in parallel with mock data. I share example requests and error responses, and I tell the team early if a field must change. For example, in my last sprint I gave QA a Postman collection with test cases for every endpoint. This reduced back-and-forth and our feature passed testing on the first cycle.

How does JWT-based authentication work?

Show answer

After a successful login, the server issues a JSON Web Token containing a header, a payload of claims such as user ID, roles and expiry, and a signature made with a secret or private key. The client sends it in the Authorization: Bearer header with each request. The server verifies the signature and expiry without a session lookup, which suits stateless APIs. Keep access tokens short-lived, do not store sensitive data in the payload because it is only encoded, and use refresh tokens for renewal.

What is CORS and how do you configure it for a React frontend?

Show answer

CORS is a browser rule that blocks JavaScript from calling a different origin unless the server allows it with response headers like Access-Control-Allow-Origin. A React app on localhost:5173 calling an API on localhost:8080 is cross-origin. In Spring, define a CorsConfigurationSource bean with the allowed origins, methods and headers, and enable http.cors() in the security chain so preflight OPTIONS requests pass. Never use a wildcard origin together with credentials.

Compare monolithic and microservices architecture.

Show answer

A monolith is one deployable application. It is simpler to build, test and debug, and suits small teams and early products. Microservices split the system into independently deployable services owned by separate teams, such as orders, payments and inventory, each with its own database. They allow independent scaling and releases but add network latency, distributed data, monitoring and deployment complexity. Many teams start with a modular monolith and split only when needed.

What roles do an API gateway and service discovery play in microservices?

Show answer

An API gateway, such as Spring Cloud Gateway, is the single entry point for clients. It handles routing, authentication, rate limiting, CORS and request logging. Service discovery lets services find each other without hard-coded addresses: with Eureka or Consul, services register themselves, and clients look them up. On Kubernetes, built-in Services and DNS usually replace a separate discovery server, and an ingress or gateway handles external traffic.

Add request validation to a registration API.

Show answer

public record RegisterRequest( @NotBlank @Size(max = 60) String name, @NotBlank @Email String email, @Pattern(regexp = "^[6-9]\\d{9}$", message = "Invalid mobile") String mobile, @Size(min = 8, max = 64) String password) {} @PostMapping("/api/auth/register") public ResponseEntity<Void> register(@Valid @RequestBody RegisterRequest req) { authService.register(req); return ResponseEntity.status(HttpStatus.CREATED).build(); } // Needs spring-boot-starter-validation. Errors raise // MethodArgumentNotValidException, mapped to 400 by the advice.

Call another microservice from Spring Boot using RestClient with a timeout.

Show answer

@Bean RestClient inventoryClient(RestClient.Builder builder) { var factory = new SimpleClientHttpRequestFactory(); factory.setConnectTimeout(2000); factory.setReadTimeout(3000); return builder.baseUrl("http://inventory-service") .requestFactory(factory).build(); } public StockDto getStock(String sku) { return inventoryClient.get() .uri("/api/stock/{sku}", sku) .retrieve() .body(StockDto.class); } // RestClient (Boot 3.2+) replaces RestTemplate for new code; // use WebClient for reactive stacks.

Your React app gets 403 Forbidden on POST requests to Spring Boot, but GET works. What is the likely cause?

Show answer

With Spring Security enabled, CSRF protection is on by default and blocks POST, PUT and DELETE that lack a CSRF token, while GET is allowed. For a stateless JWT API, disable CSRF in the SecurityFilterChain. If you use session cookies, keep CSRF and send the token with CookieCsrfTokenRepository. Also check CORS, because a rejected preflight OPTIONS request or a missing role in authorization rules can produce the same symptom.

Your public API is being hit by too many requests from a few clients. How do you add rate limiting?

Show answer

Apply rate limiting at the edge first, in the API gateway, Nginx or the cloud load balancer, keyed by API key, user ID or IP. In Spring Cloud Gateway use the Redis rate limiter, or inside a service use Bucket4j with a token bucket backed by Redis so limits work across instances. Return 429 Too Many Requests with a Retry-After header. Different plans or endpoints like login can have stricter limits.

Users must upload files up to 200 MB. How do you design the upload API?

Show answer

Avoid streaming large files through the application server. Generate a pre-signed URL for object storage like S3 or Azure Blob so the browser uploads directly, then the client calls the API to confirm and save the metadata. If uploads must go through Spring, raise spring.servlet.multipart.max-file-size, stream the input to storage instead of loading it into memory, validate type and size, and scan files for malware before use.

How do you version a REST API?

Show answer

The most common approach is URI versioning, like /api/v1/orders and /api/v2/orders, because it is visible and easy to route and cache. Other options are a custom header or the Accept media type. Spring Framework 7 adds first-class API versioning support. Version only for breaking changes; adding optional fields is backward compatible. Keep old versions running for a published deprecation period, and document every version with OpenAPI.

Tell me about a production incident you handled.

Show answer

Situation: after a release, our login API started returning 500 errors at peak time. Task: as the on-call developer I had to restore service fast. Action: I checked logs and metrics, found the new connection pool settings were too small, rolled back the config and informed stakeholders. Then I led the root cause review and added a load test to the pipeline. Result: service recovered in 20 minutes and the issue never repeated.

How do you handle a requirement that is unclear or keeps changing?

Show answer

Situation: a product manager asked for a discount feature with vague rules. Task: build it without wasting effort. Action: I wrote down my understanding with examples, asked specific questions about edge cases like stacking coupons, and built the rules as configurable data instead of hard-coded logic. I shared a small demo early for feedback. Result: two rule changes later in the sprint needed only configuration updates, not code changes.

How does the Spring Security filter chain process a request?

Show answer

Every request passes through a DelegatingFilterProxy into a FilterChainProxy, which picks the matching SecurityFilterChain. Filters run in order: CORS, CSRF, authentication filters such as BearerTokenAuthenticationFilter, exception translation and finally the authorization filter. Authentication filters build an Authentication object, validate it through the AuthenticationManager and store it in the SecurityContextHolder. The authorization filter then checks rules such as hasRole("ADMIN") before the controller runs.

What is the circuit breaker pattern and how is it implemented in Spring?

Show answer

A circuit breaker stops calling a failing downstream service so failures do not cascade. It is closed during normal operation, opens when the failure rate crosses a threshold, returns a fallback immediately while open, and moves to half-open after a wait to test recovery. In Spring Boot it is implemented with Resilience4j using @CircuitBreaker(name = "payment", fallbackMethod = "fallback"), usually combined with timeouts, retries with backoff and bulkheads.

Configure Spring Security 6 for a stateless JWT-secured REST API.

Show answer

@Configuration @EnableMethodSecurity public class SecurityConfig { @Bean SecurityFilterChain api(HttpSecurity http) throws Exception { http .csrf(csrf -> csrf.disable()) .cors(Customizer.withDefaults()) .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .authorizeHttpRequests(auth -> auth .requestMatchers("/api/auth/**", "/actuator/health").permitAll() .requestMatchers(HttpMethod.DELETE, "/api/**").hasRole("ADMIN") .anyRequest().authenticated()) .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults())); return http.build(); } }

A user's JWT is stolen and you need to invalidate it before expiry. How would you design for this?

Show answer

Pure JWTs cannot be revoked, so keep access tokens short-lived, around 10 to 15 minutes, and use refresh tokens stored server-side and rotated on each use. On logout or theft, revoke the refresh token. For immediate blocking, keep a denylist of token IDs or a per-user token version in Redis and check it in the filter. Send refresh tokens in HttpOnly, Secure, SameSite cookies to reduce theft through XSS.

An order service and a payment service have separate databases. How do you keep data consistent when placing an order?

Show answer

Avoid distributed two-phase commit. Use the saga pattern: each service performs a local transaction and publishes an event, and failures trigger compensating actions, such as cancelling the order if payment fails. Use the transactional outbox pattern so the database write and the event are saved atomically, then a relay publishes to Kafka or RabbitMQ. Make consumers idempotent because events can be delivered more than once.

A downstream service is slow, and your API threads are all stuck waiting. What do you do?