spring-projects / spring-projects/spring-security

Add a Webauth request URL customization feature.

Open
#16,361 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

I want to modify the URLs used for WebAuth authentication to be customized by WebAuthnConfigurer.
In webauthn4j-spring-security, it can modify the attachment options, assistance options, and login URLs through the configurator.
webauthn4j-spring-security repository
I want to modify them to support that function within Spring Security.

Current Behavior

AS-IS WebAuthnConfigurer only provide default associated URL. It can find from WebAuthnAuthenticationFilter, WebAuthnRegistrationFilter, PublicKeyCredentialCreationOptionsFilter, PublicKeyCredentialRequestOptionsFilter.

The configure method in WebAuthConfigurer modifies the filter chain through those instances, but there is no custom option for the URLs mentioned.

WebAuthnAuthenticationFilter webAuthnAuthnFilter = new WebAuthnAuthenticationFilter();
webAuthnAuthnFilter.setAuthenticationManager(
		new ProviderManager(new WebAuthnAuthenticationProvider(rpOperations, userDetailsService)));
http.addFilterBefore(webAuthnAuthnFilter, BasicAuthenticationFilter.class);
http.addFilterAfter(new WebAuthnRegistrationFilter(userCredentials, rpOperations), AuthorizationFilter.class);
http.addFilterBefore(new PublicKeyCredentialCreationOptionsFilter(rpOperations), AuthorizationFilter.class);
http.addFilterBefore(new PublicKeyCredentialRequestOptionsFilter(rpOperations), AuthorizationFilter.class);
public class PublicKeyCredentialRequestOptionsFilter extends OncePerRequestFilter {
	private RequestMatcher matcher = antMatcher(HttpMethod.POST, "/webauthn/authenticate/options");
// ...

public class WebAuthnRegistrationFilter extends OncePerRequestFilter {
	static final String DEFAULT_REGISTER_CREDENTIAL_URL = "/webauthn/register";
// ...

public class PublicKeyCredentialCreationOptionsFilter extends OncePerRequestFilter {
	private RequestMatcher matcher = antMatcher(HttpMethod.POST, "/webauthn/register/options");
//...

Context

Because it is difficult to customize these URLs with current Spring Security, the problem arises that backend applications are forced to follow them.
FormLoginConfigurer can customize LoginProcessingUrl . Similarly, I want to modify WebAuthnConfigurer and other filters so that URLs can be customized in that Configurator.
The immediate way to come to mind is to add URLs to the field values of WebAuthConfigurer and modify them to be set through the public method, but it may need to modify the creators of the filters together.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with WebAuthnConfigurer and trace how it creates and configures WebAuthnAuthenticationFilter, WebAuthnRegistrationFilter, PublicKeyCredentialCreationOptionsFilter, and PublicKeyCredentialRequestOptionsFilter. Confirm that the configurator can customize the authentication, registration, and options URLs, then verify the relevant Spring Security tests cover the customized routes.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.