springspring-bootspring-securitywebauthnpasskey

How to define custom onAuthenticationSuccess for Spring Security 6.4.4 webauthn (passkey) authentication?


I am using Spring Security 6.4.4 for webauthn (passkey) authentication.

depenendencies {
    implementation "org.springframework.security:spring-security-web"
    implementation "com.webauthn4j:webauthn4j-core:0.28.6.RELEASE"
}

Therefore, the FilterChain is adjusted as follows:

@Bean
SecurityFilterChain filterChain(HttpSecurity http) {
    http
        // ...
        .formLogin(withDefaults())
        .webAuthn((webAuthn) -> webAuthn
            .rpName("Spring Security Relying Party")
            .rpId("localhost")
            .allowedOrigins("http://localhost:9000")
        );
    return http.build();
}

The problem that I have, is that on successful authentication (POST /login/webauthn) I want to execute some custom logic (I want to set a JWT Token in the header).

In the constructor of WebAuthnAuthenticationFilter you can see that HttpMessageConverterAuthenticationSuccessHandler is registered as success Handler, of which I would like to overwrite the method onAuthenticationSuccess().

Is there a way to overwrite the onAuthenticationSuccess method or add another custom onAuthenticationSuccess method to the WebAuthnAuthenticationFilter?

For me it is neither clear from the documentation nor from the code how to achieve it


Solution

  • It seems like this it not configurable right now in Spring Security version 6.4.4

    I solved it like this:

    1. Implement a CustomConfigurer
      CustomConfigurer <H extends HttpSecurityBuilder<H>> extends WebAuthnConfigurer<H>

    2. Implement and use a CustomWebAuthnAuthenticationFilter

      CustomWebAuthnAuthenticationFilter extends WebAuthnAuthenticationFilter 
      
    3. Set a custom CustomHttpMessageConverterAuthenticationSuccessHandler in the CustomWebAuthnAuthenticationFilter

      CustomHttpMessageConverterAuthenticationSuccessHandler implements AuthenticationSuccessHandler