From e3a715b8f5c8b5000a24324de1f5cbe61c640b78 Mon Sep 17 00:00:00 2001 From: Borghi <137845283+Borghii@users.noreply.github.com> Date: Mon, 24 Mar 2025 12:58:08 -0300 Subject: [PATCH] Fix issues identified in PR review Signed-off-by: Borghi <137845283+Borghii@users.noreply.github.com> --- .../management/Webauthn4JRelyingPartyOperations.java | 5 +++-- .../Webauthn4jRelyingPartyOperationsTests.java | 11 ++++++++++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/web/src/main/java/org/springframework/security/web/webauthn/management/Webauthn4JRelyingPartyOperations.java b/web/src/main/java/org/springframework/security/web/webauthn/management/Webauthn4JRelyingPartyOperations.java index 98ef0cb77f..e31cb44c0e 100644 --- a/web/src/main/java/org/springframework/security/web/webauthn/management/Webauthn4JRelyingPartyOperations.java +++ b/web/src/main/java/org/springframework/security/web/webauthn/management/Webauthn4JRelyingPartyOperations.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -346,7 +346,8 @@ public class Webauthn4JRelyingPartyOperations implements WebAuthnRelyingPartyOpe } private List findCredentialRecords(Authentication authentication) { - if (authentication instanceof AnonymousAuthenticationToken) { + AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl(); + if (authentication == null || trustResolver.isAnonymous(authentication)) { return Collections.emptyList(); } PublicKeyCredentialUserEntity userEntity = this.userEntities.findByUsername(authentication.getName()); diff --git a/web/src/test/java/org/springframework/security/web/webauthn/management/Webauthn4jRelyingPartyOperationsTests.java b/web/src/test/java/org/springframework/security/web/webauthn/management/Webauthn4jRelyingPartyOperationsTests.java index fcabb7f69f..db2477ce54 100644 --- a/web/src/test/java/org/springframework/security/web/webauthn/management/Webauthn4jRelyingPartyOperationsTests.java +++ b/web/src/test/java/org/springframework/security/web/webauthn/management/Webauthn4jRelyingPartyOperationsTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -548,6 +548,15 @@ class Webauthn4jRelyingPartyOperationsTests { assertThat(credentialRequestOptions.getAllowCredentials()).isEmpty(); } + @Test + void shouldReturnEmptyCredentialsWhenAnonymousUserIsDisabled() { + PublicKeyCredentialRequestOptionsRequest createRequest = new ImmutablePublicKeyCredentialRequestOptionsRequest(null); + PublicKeyCredentialRequestOptions credentialRequestOptions = this.rpOperations + .createCredentialRequestOptions(createRequest); + + assertThat(credentialRequestOptions.getAllowCredentials()).isEmpty(); + } + private static AuthenticatorAttestationResponse setFlag(byte... flags) throws Exception { AuthenticatorAttestationResponseBuilder authAttResponseBldr = TestAuthenticatorAttestationResponse .createAuthenticatorAttestationResponse();