Merge branch '6.4.x'

2026-05-22 21:33:16 +00:00 · 2025-02-14 13:08:17 -07:00
parent f9e04594a7 946812691e
commit e42865b926
20 changed files with 155 additions and 18 deletions
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serializable;
+
 /**
 * A <a href="https://www.w3.org/TR/webauthn-3/#client-extension-output">client extension
 * output</a> entry in {@link AuthenticationExtensionsClientOutputs}.
@@ -24,7 +26,7 @@ package org.springframework.security.web.webauthn.api;
 * @see AuthenticationExtensionsClientOutputs#getOutputs()
 * @see CredentialPropertiesOutput
 */
-public interface AuthenticationExtensionsClientOutput<T> {
+public interface AuthenticationExtensionsClientOutput<T> extends Serializable {

 	/**
 	 * Gets the <a href="https://www.w3.org/TR/webauthn-3/#extension-identifier">extension
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serializable;
 import java.util.List;

 /**
@@ -31,7 +32,7 @@ import java.util.List;
 * @since 6.4
 * @see PublicKeyCredential#getClientExtensionResults()
 */
-public interface AuthenticationExtensionsClientOutputs {
+public interface AuthenticationExtensionsClientOutputs extends Serializable {

 	/**
 	 * Gets all of the {@link AuthenticationExtensionsClientOutput}.
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serial;
+
 /**
 * The <a href=
 * "https://www.w3.org/TR/webauthn-3/#authenticatorassertionresponse">AuthenticatorAssertionResponse</a>
@@ -38,6 +40,9 @@ package org.springframework.security.web.webauthn.api;
 */
 public final class AuthenticatorAssertionResponse extends AuthenticatorResponse {

+	@Serial
+	private static final long serialVersionUID = 324976481675434298L;
+
 	private final Bytes authenticatorData;

 	private final Bytes signature;
@@ -16,6 +16,10 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.ObjectStreamException;
+import java.io.Serial;
+import java.io.Serializable;
+
 /**
 * The <a href=
 * "https://www.w3.org/TR/webauthn-3/#enumdef-authenticatorattachment">AuthenticatorAttachment</a>.
@@ -23,7 +27,10 @@ package org.springframework.security.web.webauthn.api;
 * @author Rob Winch
 * @since 6.4
 */
-public final class AuthenticatorAttachment {
+public final class AuthenticatorAttachment implements Serializable {
+
+	@Serial
+	private static final long serialVersionUID = 8446133215195918090L;

 	/**
 	 * Indicates <a href=
@@ -85,4 +92,9 @@ public final class AuthenticatorAttachment {
 		return new AuthenticatorAttachment[] { CROSS_PLATFORM, PLATFORM };
 	}

+	@Serial
+	private Object readResolve() throws ObjectStreamException {
+		return valueOf(this.value);
+	}
+
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serializable;
+
 /**
 * The <a href=
 * "https://www.w3.org/TR/webauthn-3/#iface-authenticatorresponse">AuthenticatorResponse</a>
@@ -26,7 +28,7 @@ package org.springframework.security.web.webauthn.api;
 * @author Rob Winch
 * @since 6.4
 */
-public abstract class AuthenticatorResponse {
+public abstract class AuthenticatorResponse implements Serializable {

 	private final Bytes clientDataJSON;

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serial;
+import java.io.Serializable;
+
 /**
 * <a href=
 * "https://www.w3.org/TR/webauthn-3/#dictdef-credentialpropertiesoutput">CredentialPropertiesOutput</a>
@@ -27,6 +30,9 @@ package org.springframework.security.web.webauthn.api;
 public class CredentialPropertiesOutput
 		implements AuthenticationExtensionsClientOutput<CredentialPropertiesOutput.ExtensionOutput> {

+	@Serial
+	private static final long serialVersionUID = -3201699313968303331L;
+
 	/**
 	 * The extension id.
 	 */
@@ -59,7 +65,10 @@ public class CredentialPropertiesOutput
 	 * @since 6.4
 	 * @see #getOutput()
 	 */
-	public static final class ExtensionOutput {
+	public static final class ExtensionOutput implements Serializable {
+
+		@Serial
+		private static final long serialVersionUID = 4557406414847424019L;

 		private final boolean rk;

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serial;
 import java.util.Arrays;
 import java.util.List;

@@ -26,6 +27,9 @@ import java.util.List;
 */
 public class ImmutableAuthenticationExtensionsClientOutputs implements AuthenticationExtensionsClientOutputs {

+	@Serial
+	private static final long serialVersionUID = -4656390173585180393L;
+
 	private final List<AuthenticationExtensionsClientOutput<?>> outputs;

 	public ImmutableAuthenticationExtensionsClientOutputs(List<AuthenticationExtensionsClientOutput<?>> outputs) {
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@

 package org.springframework.security.web.webauthn.api;

+import java.io.Serial;
+import java.io.Serializable;
+
 /**
 * <a href="https://www.w3.org/TR/webauthn-3/#iface-pkcredential">PublicKeyCredential</a>
 * contains the attributes that are returned to the caller when a new credential is
@@ -24,7 +27,10 @@ package org.springframework.security.web.webauthn.api;
 * @author Rob Winch
 * @since 6.4
 */
-public final class PublicKeyCredential<R extends AuthenticatorResponse> {
+public final class PublicKeyCredential<R extends AuthenticatorResponse> implements Serializable {
+
+	@Serial
+	private static final long serialVersionUID = -1864035469276082606L;

 	private final String id;

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@

 package org.springframework.security.web.webauthn.authentication;

+import java.io.Serial;
+
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.web.webauthn.management.RelyingPartyAuthenticationRequest;
@@ -30,6 +32,9 @@ import org.springframework.util.Assert;
 */
 public class WebAuthnAuthenticationRequestToken extends AbstractAuthenticationToken {

+	@Serial
+	private static final long serialVersionUID = -1682693433877522403L;
+
 	private final RelyingPartyAuthenticationRequest webAuthnRequest;

 	/**
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@

 package org.springframework.security.web.webauthn.management;

+import java.io.Serial;
+import java.io.Serializable;
+
 import org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse;
 import org.springframework.security.web.webauthn.api.PublicKeyCredential;
 import org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions;
@@ -29,7 +32,10 @@ import org.springframework.util.Assert;
 * @since 6.4
 * @see WebAuthnRelyingPartyOperations#authenticate(RelyingPartyAuthenticationRequest)
 */
-public class RelyingPartyAuthenticationRequest {
+public class RelyingPartyAuthenticationRequest implements Serializable {
+
+	@Serial
+	private static final long serialVersionUID = -928083091875202086L;

 	private final PublicKeyCredentialRequestOptions requestOptions;

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2002-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.webauthn.api;
+
+/**
+ * @author Max Batischev
+ */
+public final class TestAuthenticationAssertionResponses {
+
+	public static AuthenticatorAssertionResponse.AuthenticatorAssertionResponseBuilder createAuthenticatorAssertionResponse() {
+		return AuthenticatorAssertionResponse.builder()
+			.authenticatorData(Bytes.fromBase64("SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA"))
+			.clientDataJSON(Bytes.fromBase64(
+					"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiaDB2Z3dHUWpvQ3pBekRVc216UHBrLUpWSUpSUmduMEw0S1ZTWU5SY0VaYyIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MCIsImNyb3NzT3JpZ2luIjpmYWxzZX0"))
+			.signature(Bytes.fromBase64(
+					"MEUCIAdfzPAn3voyXynwa0IXk1S0envMY5KP3NEe9aj4B2BuAiEAm_KJhQoWXdvfhbzwACU3NM4ltQe7_Il46qFUwtpuTdg"))
+			.userHandle(Bytes.fromBase64("oWJtkJ6vJ_m5b84LB4_K7QKTCTEwLIjCh4tFMCGHO4w"));
+	}
+
+	private TestAuthenticationAssertionResponses() {
+	}
+
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -38,6 +38,17 @@ public final class TestPublicKeyCredential {
 			.clientExtensionResults(clientExtensionResults);
 	}

+	public static <R extends AuthenticatorResponse> PublicKeyCredential.PublicKeyCredentialBuilder<R> createPublicKeyCredential(
+			R response, AuthenticationExtensionsClientOutputs outputs) {
+		return PublicKeyCredential.builder()
+			.id("AX6nVVERrH6opMafUGn3Z9EyNEy6cftfBKV_2YxYl1jdW8CSJxMKGXFV3bnrKTiMSJeInkG7C6B2lPt8E5i3KaM")
+			.rawId(Bytes
+				.fromBase64("AX6nVVERrH6opMafUGn3Z9EyNEy6cftfBKV_2YxYl1jdW8CSJxMKGXFV3bnrKTiMSJeInkG7C6B2lPt8E5i3KaM"))
+			.response(response)
+			.type(PublicKeyCredentialType.PUBLIC_KEY)
+			.clientExtensionResults(outputs);
+	}
+
 	private TestPublicKeyCredential() {
 	}