Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a Webauth request URL customization feature. #16361

Open
swj9707 opened this issue Jan 5, 2025 · 0 comments
Open

Add a Webauth request URL customization feature. #16361

swj9707 opened this issue Jan 5, 2025 · 0 comments
Labels
status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement

Comments

@swj9707
Copy link

swj9707 commented Jan 5, 2025

Expected Behavior

I want to modify the URLs used for WebAuth authentication to be customized by WebAuthnConfigurer.
In webauthn4j-spring-security, it can modify the attachment options, assistance options, and login URLs through the configurator.
webauthn4j-spring-security repository
I want to modify them to support that function within Spring Security.

Current Behavior

AS-IS WebAuthnConfigurer only provide default associated URL. It can find from WebAuthnAuthenticationFilter, WebAuthnRegistrationFilter, PublicKeyCredentialCreationOptionsFilter, PublicKeyCredentialRequestOptionsFilter.

The configure method in WebAuthConfigurer modifies the filter chain through those instances, but there is no custom option for the URLs mentioned.

WebAuthnAuthenticationFilter webAuthnAuthnFilter = new WebAuthnAuthenticationFilter();
webAuthnAuthnFilter.setAuthenticationManager(
		new ProviderManager(new WebAuthnAuthenticationProvider(rpOperations, userDetailsService)));
http.addFilterBefore(webAuthnAuthnFilter, BasicAuthenticationFilter.class);
http.addFilterAfter(new WebAuthnRegistrationFilter(userCredentials, rpOperations), AuthorizationFilter.class);
http.addFilterBefore(new PublicKeyCredentialCreationOptionsFilter(rpOperations), AuthorizationFilter.class);
http.addFilterBefore(new PublicKeyCredentialRequestOptionsFilter(rpOperations), AuthorizationFilter.class);
public class PublicKeyCredentialRequestOptionsFilter extends OncePerRequestFilter {
	private RequestMatcher matcher = antMatcher(HttpMethod.POST, "/webauthn/authenticate/options");
// ...

public class WebAuthnRegistrationFilter extends OncePerRequestFilter {
	static final String DEFAULT_REGISTER_CREDENTIAL_URL = "/webauthn/register";
// ...

public class PublicKeyCredentialCreationOptionsFilter extends OncePerRequestFilter {
	private RequestMatcher matcher = antMatcher(HttpMethod.POST, "/webauthn/register/options");
//...

Context

Because it is difficult to customize these URLs with current Spring Security, the problem arises that backend applications are forced to follow them.
FormLoginConfigurer can customize LoginProcessingUrl . Similarly, I want to modify WebAuthnConfigurer and other filters so that URLs can be customized in that Configurator.
The immediate way to come to mind is to add URLs to the field values of WebAuthConfigurer and modify them to be set through the public method, but it may need to modify the creators of the filters together.

@swj9707 swj9707 added status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels Jan 5, 2025
@swj9707 swj9707 changed the title Add method to customize webauthn request url Add a Webauth request URL customization feature. Jan 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement
Projects
None yet
Development

No branches or pull requests

1 participant