Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-14 08:02:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add HttpMessageConverter WebAuthnDsl Support

Browse Source 
Issue gh-16397
This commit is contained in:
Rob Winch 2025-01-17 21:07:46 -06:00
parent 683f1f4bc5
commit a2abe3c33e
No known key found for this signature in database
2 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
config/src/main/kotlin/org/springframework/security/config/annotation/web/WebAuthnDsl.kt
View File

@ -16,6 +16,7 @@
package org.springframework.security.config.annotation.web
import org.springframework.http.converter.HttpMessageConverter
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configurers.WebAuthnConfigurer
import org.springframework.security.web.webauthn.registration.PublicKeyCredentialCreationOptionsRepository
@ -37,6 +38,7 @@ class WebAuthnDsl {
var allowedOrigins: Set<String>? = null
var disableDefaultRegistrationPage: Boolean? = false
var creationOptionsRepository: PublicKeyCredentialCreationOptionsRepository? = null
var messageConverter: HttpMessageConverter<Any>? = null
internal fun get(): (WebAuthnConfigurer<HttpSecurity>) -> Unit {
return { webAuthn ->
@ -45,6 +47,7 @@ class WebAuthnDsl {
allowedOrigins?.also { webAuthn.allowedOrigins(allowedOrigins) }
disableDefaultRegistrationPage?.also { webAuthn.disableDefaultRegistrationPage(disableDefaultRegistrationPage!!) }
creationOptionsRepository?.also { webAuthn.creationOptionsRepository(creationOptionsRepository) }
messageConverter?.also { webAuthn.messageConverter(messageConverter) }
}
}
}

38
config/src/test/kotlin/org/springframework/security/config/annotation/web/WebAuthnDslTests.kt
View File

@ -22,6 +22,7 @@ import org.junit.jupiter.api.extension.ExtendWith
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
import org.springframework.security.config.test.SpringTestContext
@ -69,6 +70,16 @@ class WebAuthnDslTests {
}
}
@Test
fun `explicit HttpMessageConverter`() {
this.spring.register(ExplicitHttpMessageConverterConfig::class.java).autowire()
this.mockMvc.post("/test1")
.andExpect {
status { isForbidden() }
}
}
@Test
fun `webauthn and formLogin configured with default registration page`() {
spring.register(DefaultWebauthnConfig::class.java).autowire()
@ -166,6 +177,33 @@ class WebAuthnDslTests {
}
}
@Configuration
@EnableWebSecurity
open class ExplicitHttpMessageConverterConfig {
@Bean
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
http {
webAuthn {
rpName = "Spring Security Relying Party"
rpId = "example.com"
allowedOrigins = setOf("https://example.com")
messageConverter = MappingJackson2HttpMessageConverter()
}
}
return http.build()
}
@Bean
open fun userDetailsService(): UserDetailsService {
val userDetails = User.withDefaultPasswordEncoder()
.username("rod")
.password("password")
.roles("USER")
.build()
return InMemoryUserDetailsManager(userDetails)
}
}
@Configuration
@EnableWebSecurity
open class WebauthnConfig {