Skip to content

Commit 7fc432b

Browse files
franticticktickfranticticktick
committed
Make WebAuthnAuthenticationRequestToken Serializable
Closes gh-16481 Signed-off-by: Max Batischev <[email protected]>
1 parent 9e1a573 commit 7fc432b

18 files changed

+134
-17
lines changed

‎config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,21 +212,30 @@
212212
import org.springframework.security.web.server.firewall.ServerExchangeRejectedException;
213213
import org.springframework.security.web.session.HttpSessionCreatedEvent;
214214
import org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientInputs;
215+
import org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientOutputs;
216+
import org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse;
215217
import org.springframework.security.web.webauthn.api.AuthenticatorTransport;
216218
import org.springframework.security.web.webauthn.api.Bytes;
217219
import org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput;
220+
import org.springframework.security.web.webauthn.api.CredentialPropertiesOutput;
218221
import org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInput;
219222
import org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs;
223+
import org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientOutputs;
220224
import org.springframework.security.web.webauthn.api.ImmutablePublicKeyCredentialUserEntity;
225+
import org.springframework.security.web.webauthn.api.PublicKeyCredential;
221226
import org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor;
222227
import org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions;
223228
import org.springframework.security.web.webauthn.api.PublicKeyCredentialType;
224229
import org.springframework.security.web.webauthn.api.PublicKeyCredentialUserEntity;
230+
import org.springframework.security.web.webauthn.api.TestAuthenticationAssertionResponses;
225231
import org.springframework.security.web.webauthn.api.TestBytes;
232+
import org.springframework.security.web.webauthn.api.TestPublicKeyCredential;
226233
import org.springframework.security.web.webauthn.api.TestPublicKeyCredentialRequestOptions;
227234
import org.springframework.security.web.webauthn.api.TestPublicKeyCredentialUserEntity;
228235
import org.springframework.security.web.webauthn.api.UserVerificationRequirement;
229236
import org.springframework.security.web.webauthn.authentication.WebAuthnAuthentication;
237+
import org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationRequestToken;
238+
import org.springframework.security.web.webauthn.management.RelyingPartyAuthenticationRequest;
230239
import org.springframework.util.ReflectionUtils;
231240

232241
import static org.assertj.core.api.Assertions.assertThat;
@@ -629,6 +638,26 @@ class SpringSecurityCoreVersionSerializableTests {
629638
.allowCredentials(List.of(descriptor))
630639
.build()
631640
);
641+
642+
CredentialPropertiesOutput credentialOutput = new CredentialPropertiesOutput(false);
643+
AuthenticationExtensionsClientOutputs outputs = new ImmutableAuthenticationExtensionsClientOutputs(credentialOutput);
644+
AuthenticatorAssertionResponse response = TestAuthenticationAssertionResponses.createAuthenticatorAssertionResponse()
645+
.build();
646+
PublicKeyCredential<AuthenticatorAssertionResponse> credential = TestPublicKeyCredential.createPublicKeyCredential(
647+
response, outputs)
648+
.build();
649+
RelyingPartyAuthenticationRequest authRequest = new RelyingPartyAuthenticationRequest(
650+
TestPublicKeyCredentialRequestOptions.create().build(),
651+
credential
652+
);
653+
WebAuthnAuthenticationRequestToken requestToken = new WebAuthnAuthenticationRequestToken(authRequest);
654+
requestToken.setDetails(details);
655+
generatorByClassName.put(CredentialPropertiesOutput.class, (o) -> credentialOutput);
656+
generatorByClassName.put(ImmutableAuthenticationExtensionsClientOutputs.class, (o) -> outputs);
657+
generatorByClassName.put(AuthenticatorAssertionResponse.class, (r) -> response);
658+
generatorByClassName.put(RelyingPartyAuthenticationRequest.class, (r) -> authRequest);
659+
generatorByClassName.put(PublicKeyCredential.class, (r) -> credential);
660+
generatorByClassName.put(WebAuthnAuthenticationRequestToken.class, (r) -> requestToken);
632661
// @formatter:on
633662
}
634663

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse.serialized

782 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.webauthn.api.CredentialPropertiesOutput.serialized

306 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientOutputs.serialized

619 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.webauthn.api.PublicKeyCredential.serialized

2.03 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationRequestToken.serialized

3.8 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.webauthn.management.RelyingPartyAuthenticationRequest.serialized

3.12 KB
Binary file not shown.

‎web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticationExtensionsClientOutput.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serializable;
20+
1921
/**
2022
* A <a href="https://www.w3.org/TR/webauthn-3/#client-extension-output">client extension
2123
* output</a> entry in {@link AuthenticationExtensionsClientOutputs}.
@@ -24,7 +26,7 @@
2426
* @see AuthenticationExtensionsClientOutputs#getOutputs()
2527
* @see CredentialPropertiesOutput
2628
*/
27-
public interface AuthenticationExtensionsClientOutput<T> {
29+
public interface AuthenticationExtensionsClientOutput<T> extends Serializable {
2830

2931
/**
3032
* Gets the <a href="https://www.w3.org/TR/webauthn-3/#extension-identifier">extension

‎web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticationExtensionsClientOutputs.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serializable;
1920
import java.util.List;
2021

2122
/**
@@ -31,7 +32,7 @@
3132
* @since 6.4
3233
* @see PublicKeyCredential#getClientExtensionResults()
3334
*/
34-
public interface AuthenticationExtensionsClientOutputs {
35+
public interface AuthenticationExtensionsClientOutputs extends Serializable {
3536

3637
/**
3738
* Gets all of the {@link AuthenticationExtensionsClientOutput}.

‎web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorAssertionResponse.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serial;
20+
1921
/**
2022
* The <a href=
2123
* "https://www.w3.org/TR/webauthn-3/#authenticatorassertionresponse">AuthenticatorAssertionResponse</a>
@@ -38,6 +40,9 @@
3840
*/
3941
public final class AuthenticatorAssertionResponse extends AuthenticatorResponse {
4042

43+
@Serial
44+
private static final long serialVersionUID = 324976481675434298L;
45+
4146
private final Bytes authenticatorData;
4247

4348
private final Bytes signature;

‎web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorResponse.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serializable;
20+
1921
/**
2022
* The <a href=
2123
* "https://www.w3.org/TR/webauthn-3/#iface-authenticatorresponse">AuthenticatorResponse</a>
@@ -26,7 +28,7 @@
2628
* @author Rob Winch
2729
* @since 6.4
2830
*/
29-
public abstract class AuthenticatorResponse {
31+
public abstract class AuthenticatorResponse implements Serializable {
3032

3133
private final Bytes clientDataJSON;
3234

‎web/src/main/java/org/springframework/security/web/webauthn/api/CredentialPropertiesOutput.java

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serial;
20+
import java.io.Serializable;
21+
1922
/**
2023
* <a href=
2124
* "https://www.w3.org/TR/webauthn-3/#dictdef-credentialpropertiesoutput">CredentialPropertiesOutput</a>
@@ -27,6 +30,9 @@
2730
public class CredentialPropertiesOutput
2831
implements AuthenticationExtensionsClientOutput<CredentialPropertiesOutput.ExtensionOutput> {
2932

33+
@Serial
34+
private static final long serialVersionUID = -3201699313968303331L;
35+
3036
/**
3137
* The extension id.
3238
*/
@@ -59,7 +65,10 @@ public ExtensionOutput getOutput() {
5965
* @since 6.4
6066
* @see #getOutput()
6167
*/
62-
public static final class ExtensionOutput {
68+
public static final class ExtensionOutput implements Serializable {
69+
70+
@Serial
71+
private static final long serialVersionUID = 4557406414847424019L;
6372

6473
private final boolean rk;
6574

‎web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientOutputs.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serial;
1920
import java.util.Arrays;
2021
import java.util.List;
2122

@@ -26,6 +27,9 @@
2627
*/
2728
public class ImmutableAuthenticationExtensionsClientOutputs implements AuthenticationExtensionsClientOutputs {
2829

30+
@Serial
31+
private static final long serialVersionUID = -4656390173585180393L;
32+
2933
private final List<AuthenticationExtensionsClientOutput<?>> outputs;
3034

3135
public ImmutableAuthenticationExtensionsClientOutputs(List<AuthenticationExtensionsClientOutput<?>> outputs) {

‎web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredential.java

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
1616

1717
package org.springframework.security.web.webauthn.api;
1818

19+
import java.io.Serial;
20+
import java.io.Serializable;
21+
1922
/**
2023
* <a href="https://www.w3.org/TR/webauthn-3/#iface-pkcredential">PublicKeyCredential</a>
2124
* contains the attributes that are returned to the caller when a new credential is
@@ -24,7 +27,10 @@
2427
* @author Rob Winch
2528
* @since 6.4
2629
*/
27-
public final class PublicKeyCredential<R extends AuthenticatorResponse> {
30+
public final class PublicKeyCredential<R extends AuthenticatorResponse> implements Serializable {
31+
32+
@Serial
33+
private static final long serialVersionUID = -1864035469276082606L;
2834

2935
private final String id;
3036

@@ -34,7 +40,7 @@ public final class PublicKeyCredential<R extends AuthenticatorResponse> {
3440

3541
private final R response;
3642

37-
private final AuthenticatorAttachment authenticatorAttachment;
43+
private final transient AuthenticatorAttachment authenticatorAttachment;
3844

3945
private final AuthenticationExtensionsClientOutputs clientExtensionResults;
4046

‎web/src/main/java/org/springframework/security/web/webauthn/authentication/WebAuthnAuthenticationRequestToken.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.web.webauthn.authentication;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.authentication.AbstractAuthenticationToken;
2022
import org.springframework.security.core.authority.AuthorityUtils;
2123
import org.springframework.security.web.webauthn.management.RelyingPartyAuthenticationRequest;
@@ -30,6 +32,9 @@
3032
*/
3133
public class WebAuthnAuthenticationRequestToken extends AbstractAuthenticationToken {
3234

35+
@Serial
36+
private static final long serialVersionUID = -1682693433877522403L;
37+
3338
private final RelyingPartyAuthenticationRequest webAuthnRequest;
3439

3540
/**

‎web/src/main/java/org/springframework/security/web/webauthn/management/RelyingPartyAuthenticationRequest.java

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
1616

1717
package org.springframework.security.web.webauthn.management;
1818

19+
import java.io.Serial;
20+
import java.io.Serializable;
21+
1922
import org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse;
2023
import org.springframework.security.web.webauthn.api.PublicKeyCredential;
2124
import org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions;
@@ -29,7 +32,10 @@
2932
* @since 6.4
3033
* @see WebAuthnRelyingPartyOperations#authenticate(RelyingPartyAuthenticationRequest)
3134
*/
32-
public class RelyingPartyAuthenticationRequest {
35+
public class RelyingPartyAuthenticationRequest implements Serializable {
36+
37+
@Serial
38+
private static final long serialVersionUID = -928083091875202086L;
3339

3440
private final PublicKeyCredentialRequestOptions requestOptions;
3541

‎web/src/test/java/org/springframework/security/web/webauthn/api/TestAuthenticationAssertionResponses.java

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Copyright 2002-2025 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.web.webauthn.api;
18+
19+
/**
20+
* @author Max Batischev
21+
*/
22+
public final class TestAuthenticationAssertionResponses {
23+
24+
public static AuthenticatorAssertionResponse.AuthenticatorAssertionResponseBuilder createAuthenticatorAssertionResponse() {
25+
return AuthenticatorAssertionResponse.builder()
26+
.authenticatorData(Bytes.fromBase64("SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA"))
27+
.clientDataJSON(Bytes.fromBase64(
28+
"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiaDB2Z3dHUWpvQ3pBekRVc216UHBrLUpWSUpSUmduMEw0S1ZTWU5SY0VaYyIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MCIsImNyb3NzT3JpZ2luIjpmYWxzZX0"))
29+
.signature(Bytes.fromBase64(
30+
"MEUCIAdfzPAn3voyXynwa0IXk1S0envMY5KP3NEe9aj4B2BuAiEAm_KJhQoWXdvfhbzwACU3NM4ltQe7_Il46qFUwtpuTdg"))
31+
.userHandle(Bytes.fromBase64("oWJtkJ6vJ_m5b84LB4_K7QKTCTEwLIjCh4tFMCGHO4w"));
32+
}
33+
34+
private TestAuthenticationAssertionResponses() {
35+
}
36+
37+
}

‎web/src/test/java/org/springframework/security/web/webauthn/api/TestPublicKeyCredential.java

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -38,6 +38,17 @@ public static <R extends AuthenticatorResponse> PublicKeyCredential.PublicKeyCre
3838
.clientExtensionResults(clientExtensionResults);
3939
}
4040

41+
public static <R extends AuthenticatorResponse> PublicKeyCredential.PublicKeyCredentialBuilder<R> createPublicKeyCredential(
42+
R response, AuthenticationExtensionsClientOutputs outputs) {
43+
return PublicKeyCredential.builder()
44+
.id("AX6nVVERrH6opMafUGn3Z9EyNEy6cftfBKV_2YxYl1jdW8CSJxMKGXFV3bnrKTiMSJeInkG7C6B2lPt8E5i3KaM")
45+
.rawId(Bytes
46+
.fromBase64("AX6nVVERrH6opMafUGn3Z9EyNEy6cftfBKV_2YxYl1jdW8CSJxMKGXFV3bnrKTiMSJeInkG7C6B2lPt8E5i3KaM"))
47+
.response(response)
48+
.type(PublicKeyCredentialType.PUBLIC_KEY)
49+
.clientExtensionResults(outputs);
50+
}
51+
4152
private TestPublicKeyCredential() {
4253
}
4354

0 commit comments

Comments
 (0)