spring-projects / spring-projects/spring-security
Add a Webauth request URL customization feature.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
I want to modify the URLs used for WebAuth authentication to be customized by WebAuthnConfigurer.
In webauthn4j-spring-security, it can modify the attachment options, assistance options, and login URLs through the configurator.
webauthn4j-spring-security repository
I want to modify them to support that function within Spring Security.
Current Behavior
AS-IS WebAuthnConfigurer only provide default associated URL. It can find from WebAuthnAuthenticationFilter, WebAuthnRegistrationFilter, PublicKeyCredentialCreationOptionsFilter, PublicKeyCredentialRequestOptionsFilter.
The configure method in WebAuthConfigurer modifies the filter chain through those instances, but there is no custom option for the URLs mentioned.
WebAuthnAuthenticationFilter webAuthnAuthnFilter = new WebAuthnAuthenticationFilter();
webAuthnAuthnFilter.setAuthenticationManager(
new ProviderManager(new WebAuthnAuthenticationProvider(rpOperations, userDetailsService)));
http.addFilterBefore(webAuthnAuthnFilter, BasicAuthenticationFilter.class);
http.addFilterAfter(new WebAuthnRegistrationFilter(userCredentials, rpOperations), AuthorizationFilter.class);
http.addFilterBefore(new PublicKeyCredentialCreationOptionsFilter(rpOperations), AuthorizationFilter.class);
http.addFilterBefore(new PublicKeyCredentialRequestOptionsFilter(rpOperations), AuthorizationFilter.class);
public class PublicKeyCredentialRequestOptionsFilter extends OncePerRequestFilter {
private RequestMatcher matcher = antMatcher(HttpMethod.POST, "/webauthn/authenticate/options");
// ...
public class WebAuthnRegistrationFilter extends OncePerRequestFilter {
static final String DEFAULT_REGISTER_CREDENTIAL_URL = "/webauthn/register";
// ...
public class PublicKeyCredentialCreationOptionsFilter extends OncePerRequestFilter {
private RequestMatcher matcher = antMatcher(HttpMethod.POST, "/webauthn/register/options");
//...
Context
Because it is difficult to customize these URLs with current Spring Security, the problem arises that backend applications are forced to follow them.
FormLoginConfigurer can customize LoginProcessingUrl . Similarly, I want to modify WebAuthnConfigurer and other filters so that URLs can be customized in that Configurator.
The immediate way to come to mind is to add URLs to the field values of WebAuthConfigurer and modify them to be set through the public method, but it may need to modify the creators of the filters together.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with WebAuthnConfigurer and trace how it creates and configures WebAuthnAuthenticationFilter, WebAuthnRegistrationFilter, PublicKeyCredentialCreationOptionsFilter, and PublicKeyCredentialRequestOptionsFilter. Confirm that the configurator can customize the authentication, registration, and options URLs, then verify the relevant Spring Security tests cover the customized routes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100