spring-projects / spring-projects/spring-security
Lazily instantiate default components in WebAuthnConfigurer
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Avoid unnecessary instantiation of MapPublicKeyCredentialUserEntityRepository and MapUserCredentialRepository in WebAuthnConfigurer
In the configure method of WebAuthnConfigurer, Optional.orElse() is currently
used to provide default implementations when specific Beans are not found
in the ApplicationContext.
public class WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
extends AbstractHttpConfigurer<WebAuthnConfigurer<H>, H> {
// ...
@Override
public void configure(H http) {
/ ...
// Uses orElse(): Always instantiates default repositories
PublicKeyCredentialUserEntityRepository userEntities = getSharedOrBean(http,
PublicKeyCredentialUserEntityRepository.class)
.orElse(userEntityRepository());
UserCredentialRepository userCredentials = getSharedOrBean(http, UserCredentialRepository.class)
.orElse(userCredentialRepository());
/ ...
}
}
However, orElse() evaluates its argument eagerly. As a result,
userEntityRepository() and userCredentialRepository() are always invoked,
instantiating new repository objects even when a corresponding repository
Bean is already present in the ApplicationContext.
This leads to unnecessary object creation each time the configuration
is initialized.
I propose replacing orElse with orElseGet to ensure that the default
repositories are instantiated only when the Optional is empty.
public void configure(H http) {
// Uses orElseGet(): Instantiates only when necessary
PublicKeyCredentialUserEntityRepository userEntities = getSharedOrBean(http,
PublicKeyCredentialUserEntityRepository.class)
.orElseGet(this::userEntityRepository);
UserCredentialRepository userCredentials = getSharedOrBean(http, UserCredentialRepository.class)
.orElseGet(this::userCredentialRepository);
}
This change aligns with Java Optional best practices by avoiding unnecessary
object creation and ensuring that default components are initialized only
when they are actually needed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the configure method of WebAuthnConfigurer and inspect userEntityRepository() and userCredentialRepository(). Replace the eager Optional defaults with lazy defaults, then verify that the default repositories are created only when the corresponding ApplicationContext beans are absent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100