spring-projects / spring-projects/spring-security

Lazily instantiate default components in WebAuthnConfigurer

Open Beginner friendly
#18,585 1 comment 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Avoid unnecessary instantiation of MapPublicKeyCredentialUserEntityRepository and MapUserCredentialRepository in WebAuthnConfigurer

In the configure method of WebAuthnConfigurer, Optional.orElse() is currently
used to provide default implementations when specific Beans are not found
in the ApplicationContext.

public class WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractHttpConfigurer<WebAuthnConfigurer<H>, H> {
         // ... 
	@Override
	public void configure(H http) {
                 / ...
                 // Uses orElse(): Always instantiates default repositories
		PublicKeyCredentialUserEntityRepository userEntities = getSharedOrBean(http,
				PublicKeyCredentialUserEntityRepository.class)
			.orElse(userEntityRepository());
		UserCredentialRepository userCredentials = getSharedOrBean(http, UserCredentialRepository.class)
			.orElse(userCredentialRepository());
                 / ... 
    } 
} 

However, orElse() evaluates its argument eagerly. As a result,
userEntityRepository() and userCredentialRepository() are always invoked,
instantiating new repository objects even when a corresponding repository
Bean is already present in the ApplicationContext.

This leads to unnecessary object creation each time the configuration
is initialized.

I propose replacing orElse with orElseGet to ensure that the default
repositories are instantiated only when the Optional is empty.

	public void configure(H http) {

                 // Uses orElseGet(): Instantiates only when necessary
		PublicKeyCredentialUserEntityRepository userEntities = getSharedOrBean(http,
				PublicKeyCredentialUserEntityRepository.class)
			.orElseGet(this::userEntityRepository);
		UserCredentialRepository userCredentials = getSharedOrBean(http, UserCredentialRepository.class)
			.orElseGet(this::userCredentialRepository);
    } 

This change aligns with Java Optional best practices by avoiding unnecessary
object creation and ensuring that default components are initialized only
when they are actually needed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the configure method of WebAuthnConfigurer and inspect userEntityRepository() and userCredentialRepository(). Replace the eager Optional defaults with lazy defaults, then verify that the default repositories are created only when the corresponding ApplicationContext beans are absent.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Refactor
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.