Merge pull request #1 from webauthn4j/master

Merging upstream project

Author: TGITS

build.gradle

@@ -17,18 +17,18 @@
 buildscript {
     ext{
         //Plugins
-        springBootVersion = '2.7.5'
+        springBootVersion = '2.7.8'
         sonarqubeVersion = '3.5.0.2730'
         asciidoctorGradleVersion = "3.3.2"
         artifactoryVersion = '4.31.0'
         bintrayVersion = '1.8.5'
-        owaspDependencyCheckVersion = '8.0.1'
+        owaspDependencyCheckVersion = '8.0.2'
         httpBuilderVersion = '0.7.2'
 
         //Libraries
         webauthn4jVersion = '0.20.6.RELEASE'
-        springSecurityVersion = '5.7.5'
-        hibernateValidatorVersion = '6.2.4.Final'
+        springSecurityVersion = '5.7.6'
+        hibernateValidatorVersion = '6.2.5.Final'
         thymeleafVersion = '3.0.4.RELEASE'
         modelMapperVersion = '3.1.1'
 

docs/src/reference/asciidoc/en/configuration.adoc

@@ -12,7 +12,7 @@ Please add following to pom.xml to introduce WebAuthn4J Spring Security and its
 <properties>
   ...
   <!-- Use the latest version whenever possible. -->
-  <webauthn4j-spring-security.version>0.7.0.RELEASE</webauthn4j-spring-security.version>
+  <webauthn4j-spring-security.version>0.7.6.RELEASE</webauthn4j-spring-security.version>
   ...
 </properties>
 
@@ -102,7 +102,7 @@ Regarding WebAuthn4J Spring Security, `WebAuthnProcessingFilter` retrieves `cred
 
 ==== WebAuthn registration request processing
 
-Not like authentication request processing, Servlet filter is not provided for registration request processing
+In contrast to authentication request processing, Servlet filter is not provided for registration request processing
 because in most cases, data other than WebAuthn like user's first name, last name, or email address are sent at the same time.
 
 While it is basically application's responsibility to handle an authenticator registration process, WebAuthn4J Spring Security provides converters and validators to examine the received credential.
@@ -114,7 +114,7 @@ While it is basically application's responsibility to handle an authenticator re
 ==== Options endpoints
 
 Web Authentication needs to obtain a challenge from the server prior to registration and authentication.
-When using the FIDO-U2F token as an authentication device, the CredentialIds associated with the user identified by the first authentication factor are also need to be obtained from the server.
+When using the FIDO-U2F token as an authentication device, the CredentialIds associated with the user identified by the first authentication factor also need to be obtained from the server.
 To retrieve these data, WebAuthn4J Spring Security offers `AttestationOptionsEndpointFilter` and `AssertionOptionsEndpointFilter`.
 
 === Customization
@@ -135,7 +135,7 @@ For WebAuthn assertion verification, `WebAuthnManager` is used. See https://weba
 WebAuthn4J Spring Security provides `AttestationOptionsEndpointFilter` for WebAuthn JS Credential Creation API parameters serving, and `AssertionOptionsEndpointFilter` for WebAuthn JS Credential Get API parameter serving.
 As these Parameters generation are delegated through `AttestationOptionsProvider` and `AssertionOptionsProvider` interfaces, they can be customized by implementing these interfaces.
 
-These can be customized through Java Config. Method chains from `WebAuthnLoginConfigurer`'s `attestationOptionsEndpoint` method or `assertionOptionsEndpoint` method are configuration point for that.
+These can be customized through Java Config. Method chains from `WebAuthnLoginConfigurer` 's `attestationOptionsEndpoint` method or `assertionOptionsEndpoint` method are configuration point for that.
 
 [source,java]
 ----
@@ -181,7 +181,7 @@ public class WebSecurityConfig {
 
 ===== Dynamic generation of PublicKeyCredentialUserEntity
 
-Attestation options endpoint can generate `PublicKeyCredentialUserEntity` to be returned dynamically based on the `Authentication` object associated with login user.
+Attestation options endpoint can generate `PublicKeyCredentialUserEntity` to be returned dynamically based on the `Authentication` object associated with logged-in user.
 To generate `PublicKeyCredentialUserEntity`, `PublicKeyCredentialUserEntityProvider` is provided.
 
 Speaking of Java Config, it can be set in this way:
@@ -203,10 +203,9 @@ public class WebSecurityConfig {
 }
 ----
 
-If `PublicKeyCredentialUserEntityProvider` is not set explicitly, WebAuthn4J Spring Security Java Config look up it from Spring Application Context.
+If `PublicKeyCredentialUserEntityProvider` is not set explicitly, WebAuthn4J Spring Security Java Config looks it up from Spring Application Context.
 Registering its bean to the application context is another way to set it.
 
-
 ==== Selecting authentication method
 
 WebAuthn4J Spring Security supports "Password-less multi-factor authentication with a user-verifying authenticator", "Multi-factor authentication with password and authenticator" and "Single-factor authentication like password".
@@ -218,7 +217,7 @@ To realize "Multi-factor authentication with password and authenticator" and "Si
 "Multi-factor authentication with password and authenticator" can be realized by including additional authorization requirement to check a user is authenticated by WebAuthn.
 
 Whether it is authenticated by WebAuthn can be checked with the `WebAuthnSecurityExpression#isWebAuthnAuthenticated` method.
-Register a bean of WebAuthnSecurityExpression instance and call it from JavaConfig. WebAuthn4J Spring Security Sample MPA is a good example for it.
+Register a bean of `WebAuthnSecurityExpression` instance and call it from JavaConfig. WebAuthn4J Spring Security Sample MPA is a good example for it.
 
 === Advanced topics
 
@@ -252,10 +251,10 @@ If you would like to change `rpId` dynamically based on request, set `RpIdProvid
 
 ==== Attestation statement verification
 
-Web Authentication specification allows the relying party to retrieve an attestation statement from an authenticator if it is requested while authenticator registration.
+Web Authentication specification allows the relying party to retrieve an attestation statement from an authenticator if it is requested during authenticator registration.
 By verifying attestation statement, the relying party can exclude authenticators not conforming its security requirements.
 It's to be noted that the attestation statement contains information that can be used to track user across web sites, it is discouraged to request an attestation statement unnecessarily.
-It is also to be noted that the browsers shows an additional dialog to confirm the user consent, lowers usability.
+It is also to be noted that the browser shows an additional dialog to confirm the user consent, lowering usability.
 Except for enterprise applications that require strict verification of authenticators, most sites should not request attestation statements.
 
 `WebAuthnRegistrationContextValidator` from WebAuthn4J validates an authenticator registration request, and it delegates attestation statement signature and trustworthiness validation to `WebAuthnManager` and

docs/src/reference/asciidoc/en/quick-start.adoc

@@ -1,9 +1,9 @@
 
 == Quick start
 
-WebAuthn4J Spring Security contains a sample application demonstrates its major functionality.
+WebAuthn4J Spring Security contains a sample application which demonstrates its major functionality.
 
-It can be launched with a following command.
+It can be launched with the following command.
 
 [source,bash]
 ----

docs/src/reference/asciidoc/en/sample-app.adoc

@@ -1,7 +1,7 @@
 
 == Sample application
 
-WebAuthn4J Spring Security contains a sample application demonstrates its major functionality.
+WebAuthn4J Spring Security contains a sample application demonstrating its major functionalities.
 Sample SPA is a demo of Single Page Application. Sample MPA is a demo of traditional Multi Page Application.
 Sample SPA is explained below.
 

samples/fido-server-conformance-test-app/build.gradle

@@ -42,7 +42,7 @@ dependencies {
     implementation('org.flywaydb:flyway-core')
     runtimeOnly('ch.qos.logback:logback-classic')
     runtimeOnly('com.h2database:h2')
-    runtimeOnly('mysql:mysql-connector-java')
+    runtimeOnly('com.mysql:mysql-connector-j')
     runtimeOnly("org.lazyluke:log4jdbc-remix")
 
     //Test