spring-projects / spring-projects/spring-security
Missing sid- and auth_time-claims in ID-token in case of WebAuthn
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
After signing in with WebAuthn, the OIDC id_token is missing the sid and auth_time claims.
In the same setup, a username/password login includes both claims as expected.
This leads to inconsistent ID token contents depending on the authentication method.
To Reproduce
- git clone https://github.com/alsha/sas-webauthn-idtoken-repro
- cd sas-webauthn-idtoken-repro
- mvn test
Cause of the issue
The problem appears to be related to the implementation of the SpringSessionBackedSessionRegistry.name(...) method.
SessionRegistryImpl behaves correctly.
Expected behavior
sid and auth_time should be present in the OIDC id_token after successful WebAuthn login as well, same as after username/password login.
Sample
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Run the linked reproduction with mvn test to observe the missing claims after WebAuthn login. Read SpringSessionBackedSessionRegistry.name(...) and compare its behavior with SessionRegistryImpl; verify that successful WebAuthn and username/password logins produce ID tokens containing both sid and auth_time.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100