spring-projects / spring-projects/spring-security-samples
authentication object is null for second-factor and third-factor post methods in MfaController in mfa module
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.8k
- Forks
- 797
- Avg merge
- 3m
- Merged PRs (30d)
- 5
Description
I fail to pass through the second factor and third factor authentication in the mfa module because in the both case the MfaAuthentication authentication is null
Below is more detail explanation:
in /mfa/src/main/java/example/MfaController.java file
@PostMapping("/second-factor")
public void processSecondFactor(@RequestParam("code") String code, MfaAuthentication authentication,
HttpServletRequest request, HttpServletResponse response) throws Exception {
// authentication object is null but if I write it like below, I get the authentication object
// MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication();
MfaAuthenticationHandler handler = new MfaAuthenticationHandler("/third-factor");
...
}
@PostMapping("/third-factor")
public void processThirdFactor(@RequestParam("answer") String answer, MfaAuthentication authentication,
HttpServletRequest request, HttpServletResponse response) throws Exception {
// authentication object is null but if I write it like below, I get the authentication object
// MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication();
String encodedAnswer = getAnswer(authentication);
...
}
Can anyone explain why this is happening? I tried to debug but fail to get any explanation.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with mfa/src/main/java/example/MfaController.java and reproduce the second-factor and third-factor POST requests in the MFA sample. Compare the method parameters with SecurityContextHolder usage and trace how authentication arguments are resolved. Done means explaining the null parameter and documenting or correcting the sample behavior, with the relevant MFA flow verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100