spring-projects / spring-projects/spring-security
Consider Exposing WebAuthnRegisteredPredicate
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
When users perform custom programatic MFA which changes based upon if a webauthn credential is registered, it would be helpful for them to be able to reuse the logic for determining if the user has webauthn credential registered. One way to do this would be to expose WebAuthnRegisteredPredicate in the webauthn module.
It's worth thinking about the impact on performance though. Every authorization rule will need to invoke multiple database queries which can impact performance significantly. It may be better if we provide a more optimized experience around this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating WebAuthnRegisteredPredicate in the webauthn module and reviewing how custom programmatic MFA and authorization rules invoke credential checks. Determine whether exposing the predicate is sufficient or whether a more optimized approach is needed, with completion defined by an agreed API and acceptable database-query performance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100