Skip to content

Commit c0d7026

Browse files
ynojimaynojima
authored
Merge pull request #1406 from webauthn4j/dependabot/gradle/springBootVersion-3.2.5
chore(deps): bump springBootVersion from 3.0.5 to 3.2.5
2 parents cc1e47e + dc63853 commit c0d7026

File tree

10 files changed

+272
-213
lines changed

10 files changed

+272
-213
lines changed

‎build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
buildscript {
1818
ext{
1919
//Plugins
20-
springBootVersion = '3.0.5'
20+
springBootVersion = '3.2.5'
2121
sonarqubeVersion = '5.0.0.4638'
2222
asciidoctorGradleVersion = "4.0.2"
2323
artifactoryVersion = '5.2.0'

‎docs/src/reference/asciidoc/en/configuration.adoc‎

Lines changed: 39 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -36,25 +36,36 @@ public class WebSecurityConfig {
3636
3737
@Bean
3838
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
39+
40+
http.authenticationManager(authenticationManager);
3941
// WebAuthn Login
40-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
41-
.loginPage("/login")
42-
.usernameParameter("username")
43-
.passwordParameter("rawPassword")
44-
.credentialIdParameter("credentialId")
45-
.clientDataJSONParameter("clientDataJSON")
46-
.authenticatorDataParameter("authenticatorData")
47-
.signatureParameter("signature")
48-
.clientExtensionsJSONParameter("clientExtensionsJSON")
49-
.loginProcessingUrl("/login")
50-
.rpId("example.com")
51-
.attestationOptionsEndpoint()
52-
.attestationOptionsProvider(attestationOptionsProvider)
53-
.and()
54-
.assertionOptionsEndpoint()
55-
.assertionOptionsProvider(assertionOptionsProvider)
56-
.and()
57-
.authenticationManager(authenticationManager);
42+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
43+
customizer
44+
.loginPage("/login")
45+
.usernameParameter("username")
46+
.passwordParameter("password")
47+
.credentialIdParameter("credentialId")
48+
.clientDataJSONParameter("clientDataJSON")
49+
.authenticatorDataParameter("authenticatorData")
50+
.signatureParameter("signature")
51+
.clientExtensionsJSONParameter("clientExtensionsJSON")
52+
.loginProcessingUrl("/login")
53+
.attestationOptionsEndpoint()
54+
.rp()
55+
.name("WebAuthn4J Spring Security Sample")
56+
.and()
57+
.pubKeyCredParams(
58+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS256), // Windows Hello
59+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256) // FIDO U2F Key, etc
60+
)
61+
.extensions()
62+
.credProps(true)
63+
.and()
64+
.assertionOptionsEndpoint()
65+
.and()
66+
.successHandler(authenticationSuccessHandler)
67+
.failureHandler(authenticationFailureHandler);
68+
});
5869
}
5970
}
6071
----
@@ -144,8 +155,10 @@ public class WebSecurityConfig {
144155
145156
@Bean
146157
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
158+
http.authenticationManager(authenticationManager);
147159
// WebAuthn Login
148-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
160+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
161+
customizer
149162
.rpId("example.com")
150163
.attestationOptionsEndpoint()
151164
.attestationOptionsProvider(attestationOptionsProvider)
@@ -172,8 +185,8 @@ public class WebSecurityConfig {
172185
.processingUrl("/webauthn/assertion/options")
173186
.rpId("example.com")
174187
.userVerification(UserVerificationRequirement.PREFERRED)
175-
.and()
176-
.authenticationManager(authenticationManager);
188+
.and();
189+
});
177190
}
178191
}
179192
@@ -192,13 +205,16 @@ public class WebSecurityConfig {
192205
193206
@Bean
194207
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
208+
195209
// WebAuthn Login
196-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
210+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
211+
customizer
197212
.attestationOptionsEndpoint()
198213
.attestationOptionsProvider(attestationOptionsProvider)
199214
.processingUrl("/webauthn/attestation/options")
200215
.processingUrl("/webauthn/attestation/options")
201-
.user(new MyPublicKeyCredentialUserEntityProvider()) // put your PublicKeyCredentialUserEntityProvider implementation
216+
.user(new MyPublicKeyCredentialUserEntityProvider()); // put your PublicKeyCredentialUserEntityProvider implementation
217+
});
202218
}
203219
}
204220
----

‎docs/src/reference/asciidoc/ja/configuration.adoc‎

Lines changed: 39 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -36,25 +36,36 @@ public class WebSecurityConfig {
3636
3737
@Bean
3838
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
39+
40+
http.authenticationManager(authenticationManager);
3941
// WebAuthn Login
40-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
41-
.loginPage("/login")
42-
.usernameParameter("username")
43-
.passwordParameter("rawPassword")
44-
.credentialIdParameter("credentialId")
45-
.clientDataJSONParameter("clientDataJSON")
46-
.authenticatorDataParameter("authenticatorData")
47-
.signatureParameter("signature")
48-
.clientExtensionsJSONParameter("clientExtensionsJSON")
49-
.loginProcessingUrl("/login")
50-
.rpId("example.com")
51-
.attestationOptionsEndpoint()
52-
.attestationOptionsProvider(attestationOptionsProvider)
53-
.and()
54-
.assertionOptionsEndpoint()
55-
.assertionOptionsProvider(assertionOptionsProvider)
56-
.and()
57-
.authenticationManager(authenticationManager);
42+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
43+
customizer
44+
.loginPage("/login")
45+
.usernameParameter("username")
46+
.passwordParameter("password")
47+
.credentialIdParameter("credentialId")
48+
.clientDataJSONParameter("clientDataJSON")
49+
.authenticatorDataParameter("authenticatorData")
50+
.signatureParameter("signature")
51+
.clientExtensionsJSONParameter("clientExtensionsJSON")
52+
.loginProcessingUrl("/login")
53+
.attestationOptionsEndpoint()
54+
.rp()
55+
.name("WebAuthn4J Spring Security Sample")
56+
.and()
57+
.pubKeyCredParams(
58+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS256), // Windows Hello
59+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256) // FIDO U2F Key, etc
60+
)
61+
.extensions()
62+
.credProps(true)
63+
.and()
64+
.assertionOptionsEndpoint()
65+
.and()
66+
.successHandler(authenticationSuccessHandler)
67+
.failureHandler(authenticationFailureHandler);
68+
});
5869
}
5970
}
6071
----
@@ -149,8 +160,10 @@ public class WebSecurityConfig {
149160
150161
@Bean
151162
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
163+
http.authenticationManager(authenticationManager);
152164
// WebAuthn Login
153-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
165+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
166+
customizer
154167
.rpId("example.com")
155168
.attestationOptionsEndpoint()
156169
.attestationOptionsProvider(attestationOptionsProvider)
@@ -177,8 +190,8 @@ public class WebSecurityConfig {
177190
.processingUrl("/webauthn/assertion/options")
178191
.rpId("example.com")
179192
.userVerification(UserVerificationRequirement.PREFERRED)
180-
.and()
181-
.authenticationManager(authenticationManager);
193+
.and();
194+
});
182195
}
183196
}
184197
----
@@ -197,13 +210,16 @@ public class WebSecurityConfig {
197210
198211
@Bean
199212
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
213+
200214
// WebAuthn Login
201-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
215+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
216+
customizer
202217
.attestationOptionsEndpoint()
203218
.attestationOptionsProvider(attestationOptionsProvider)
204219
.processingUrl("/webauthn/attestation/options")
205220
.processingUrl("/webauthn/attestation/options")
206-
.user(new MyPublicKeyCredentialUserEntityProvider()) // put your PublicKeyCredentialUserEntityProvider implementation
221+
.user(new MyPublicKeyCredentialUserEntityProvider()); // put your PublicKeyCredentialUserEntityProvider implementation
222+
});
207223
}
208224
}
209225
----

‎samples/fido-server-conformance-test-app/src/main/java/com/webauthn4j/springframework/security/webauthn/sample/app/config/WebSecurityConfig.java‎

Lines changed: 36 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -113,23 +113,25 @@ public WebSecurityCustomizer webSecurityCustomizer() {
113113
@Bean
114114
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
115115
// WebAuthn Config
116-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
117-
.attestationOptionsEndpoint()
118-
.rp()
119-
.name("WebAuthn4J Spring Security Sample")
120-
.and()
121-
.pubKeyCredParams(
122-
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256),
123-
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS1),
124-
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.EdDSA)
125-
)
126-
.extensions()
127-
.entry("example.extension", "test")
128-
.and()
129-
.assertionOptionsEndpoint()
130-
.extensions()
131-
.entry("example.extension", "test")
132-
.and();
116+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer)->{
117+
customizer
118+
.attestationOptionsEndpoint()
119+
.rp()
120+
.name("WebAuthn4J Spring Security Sample")
121+
.and()
122+
.pubKeyCredParams(
123+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256),
124+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS1),
125+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.EdDSA)
126+
)
127+
.extensions()
128+
.entry("example.extension", "test")
129+
.and()
130+
.assertionOptionsEndpoint()
131+
.extensions()
132+
.entry("example.extension", "test")
133+
.and();
134+
});
133135

134136
FidoServerAttestationOptionsEndpointFilter fidoServerAttestationOptionsEndpointFilter = new FidoServerAttestationOptionsEndpointFilter(objectConverter, attestationOptionsProvider, challengeRepository);
135137
FidoServerAttestationResultEndpointFilter fidoServerAttestationResultEndpointFilter = new FidoServerAttestationResultEndpointFilter(objectConverter, userDetailsManager, webAuthnAuthenticatorManager, webAuthnRegistrationRequestValidator);
@@ -144,21 +146,25 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager
144146
http.addFilterAfter(fidoServerAssertionResultEndpointFilter, SessionManagementFilter.class);
145147

146148
// Authorization
147-
http.authorizeHttpRequests()
148-
.requestMatchers("/").permitAll()
149-
.requestMatchers("/api/auth/status").permitAll()
150-
.requestMatchers(HttpMethod.GET, "/login").permitAll()
151-
.requestMatchers(HttpMethod.POST, "/api/profile").permitAll()
152-
.requestMatchers("/health/**").permitAll()
153-
.requestMatchers("/info/**").permitAll()
154-
.requestMatchers("/h2-console/**").denyAll()
155-
.requestMatchers("/api/admin/**").hasRole(ADMIN_ROLE)
156-
.anyRequest().fullyAuthenticated();
149+
http.authorizeHttpRequests(customizer -> {
150+
customizer
151+
.requestMatchers("/").permitAll()
152+
.requestMatchers("/api/auth/status").permitAll()
153+
.requestMatchers(HttpMethod.GET, "/login").permitAll()
154+
.requestMatchers(HttpMethod.POST, "/api/profile").permitAll()
155+
.requestMatchers("/health/**").permitAll()
156+
.requestMatchers("/info/**").permitAll()
157+
.requestMatchers("/h2-console/**").denyAll()
158+
.requestMatchers("/api/admin/**").hasRole(ADMIN_ROLE)
159+
.anyRequest().fullyAuthenticated();
160+
});
157161

158-
//TODO:
159-
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
160162

161-
http.csrf().ignoringRequestMatchers("/webauthn/**");
163+
//TODO:
164+
http.csrf(customizer -> {
165+
customizer.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
166+
customizer.ignoringRequestMatchers("/webauthn/**");
167+
});
162168

163169
http.authenticationManager(authenticationManager);
164170

‎samples/mpa/src/main/java/com/webauthn4j/springframework/security/webauthn/sample/app/config/WebSecurityConfig.java‎

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3838
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
3939
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
40+
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
4041
import org.springframework.security.core.userdetails.UserDetailsService;
4142
import org.springframework.security.crypto.password.PasswordEncoder;
4243
import org.springframework.security.web.SecurityFilterChain;
@@ -86,32 +87,34 @@ public WebSecurityCustomizer webSecurityCustomizer() {
8687
@Bean
8788
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
8889
// WebAuthn Login
89-
http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
90-
.defaultSuccessUrl("/", true)
91-
.failureUrl("/login")
92-
.attestationOptionsEndpoint()
93-
.rp()
94-
.name("WebAuthn4J Spring Security Sample")
95-
.and()
96-
.pubKeyCredParams(
97-
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256),
98-
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS1)
99-
)
100-
.attestation(AttestationConveyancePreference.NONE)
101-
.extensions()
102-
.uvm(true)
103-
.credProps(true)
104-
.extensionProviders()
105-
.and()
106-
.assertionOptionsEndpoint()
107-
.extensions()
108-
.extensionProviders();
90+
http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer)-> {
91+
customizer
92+
.defaultSuccessUrl("/", true)
93+
.failureUrl("/login")
94+
.attestationOptionsEndpoint()
95+
.rp()
96+
.name("WebAuthn4J Spring Security Sample")
97+
.and()
98+
.pubKeyCredParams(
99+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256),
100+
new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS1)
101+
)
102+
.attestation(AttestationConveyancePreference.NONE)
103+
.extensions()
104+
.uvm(true)
105+
.credProps(true)
106+
.extensionProviders()
107+
.and()
108+
.assertionOptionsEndpoint()
109+
.extensions()
110+
.extensionProviders();
111+
});
109112

110113
http.headers(headers -> {
111114
// 'publickey-credentials-get *' allows getting WebAuthn credentials to all nested browsing contexts (iframes) regardless of their origin.
112115
headers.permissionsPolicy(config -> config.policy("publickey-credentials-get *"));
113116
// Disable "X-Frame-Options" to allow cross-origin iframe access
114-
headers.frameOptions().disable();
117+
headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable);
115118
});
116119

117120

@@ -123,14 +126,18 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager
123126
.anyRequest().access(getWebExpressionAuthorizationManager("@webAuthnSecurityExpression.isWebAuthnAuthenticated(authentication) || hasAuthority('SINGLE_FACTOR_AUTHN_ALLOWED')"))
124127
);
125128

126-
http.exceptionHandling()
127-
.accessDeniedHandler((request, response, accessDeniedException) -> response.sendRedirect("/login"));
129+
http.exceptionHandling(customizer -> {
130+
customizer.accessDeniedHandler((request, response, accessDeniedException) -> response.sendRedirect("/login"));
131+
});
132+
128133

129134
http.authenticationManager(authenticationManager);
130135

131136
// As WebAuthn has its own CSRF protection mechanism (challenge), CSRF token is disabled here
132-
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
133-
http.csrf().ignoringRequestMatchers("/webauthn/**");
137+
http.csrf(customizer -> {
138+
customizer.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
139+
customizer.ignoringRequestMatchers("/webauthn/**");
140+
});
134141

135142
return http.build();
136143

0 commit comments

Comments
 (0)