https://github.com/webauthn4j/webauthn4j-spring-security

WebAuthn4J Extension for Spring Security
https://github.com/webauthn4j/webauthn4j-spring-security

fido fido-u2f fido2 java passkey spring spring-security webauthn webauthn4j-spring-security

Last synced: 3 months ago
JSON representation

WebAuthn4J Extension for Spring Security

• Host: GitHub
• URL: https://github.com/webauthn4j/webauthn4j-spring-security
• Owner: webauthn4j
• License: apache-2.0
• Created: 2018-03-17T16:01:11.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2024-07-26T07:01:02.000Z (4 months ago)
• Last Synced: 2024-07-28T17:38:24.228Z (3 months ago)
• Topics: fido, fido-u2f, fido2, java, passkey, spring, spring-security, webauthn, webauthn4j-spring-security
• Language: Java
• Homepage:
• Size: 23.9 MB
• Stars: 172
• Watchers: 14
• Forks: 41
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

• awesome-webauthn - SharpLab: Spring-Security-WebAuthn - Unofficial WebAuthn module for the Spring Security project. (Server Libraries)

README

        
# WebAuthn4J Spring Security

[![Actions Status](https://github.com/webauthn4j/webauthn4j-spring-security/workflows/CI/badge.svg)](https://github.com/webauthn4j/webauthn4j-spring-security/actions)

[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=webauthn4j-spring-security&metric=coverage)](https://sonarcloud.io/dashboard?id=webauthn4j-spring-security)

[![Maven Central](https://img.shields.io/maven-central/v/com.webauthn4j/webauthn4j-spring-security-core.svg)](https://search.maven.org/search?q=webauthn4j-spring-security)

[![license](https://img.shields.io/github/license/webauthn4j/webauthn4j-spring-security.svg)](https://github.com/webauthn4j/webauthn4j-spring-security/blob/master/LICENSE.txt)

WebAuthn4J Spring Security provides [Web Authentication specification](https://www.w3.org/TR/2019/REC-webauthn-1-20190304/) support for your Spring application by using [WebAuthn4J library](https://github.com/webauthn4j/webauthn4j).

Users can login with WebAuthn compliant authenticator.

## Project status

This project is under active development. API signature may change.

## Documentation

You can find out more details from the [reference](https://webauthn4j.github.io/webauthn4j-spring-security/en/).

## Getting from Maven Central

If you are using Maven, just add the webauthn4j-spring-security as a dependency:

```xml

  ...

  

  0.10.0.RELEASE

  ...

	com.webauthn4j

	webauthn4j-spring-security-core

	${webauthn4j-spring-security.version}

```

## Build

WebAuthn4J Spring Security uses a Gradle based build system.

In the instructions below, `gradlew` is invoked from the root of the source tree and serves as a cross-platform,

self-contained bootstrap mechanism for the build.

### Prerequisites

- Java8 or later

- Spring Framework 5.0 or later

### Checkout sources

```bash

git clone https://github.com/webauthn4j/webauthn4j-spring-security

```

### Build all jars

```bash

./gradlew build

```

### Execute sample application

```bash

./gradlew samples:spa:bootRun

```

![Login view](./docs/src/reference/asciidoc/en/images/login.png "Login view")

## Configuration

WebAuthn4J Spring Security can be configured through Spring Security Java Config.

```java

@Configuration

@EnableWebSecurity

public class WebSecurityConfig {

    @Bean

    public WebAuthnAuthenticationProvider webAuthnAuthenticationProvider(WebAuthnAuthenticatorService authenticatorService, WebAuthnManager webAuthnManager){

        return new WebAuthnAuthenticationProvider(authenticatorService, webAuthnManager);

    }

    @Bean

    public DaoAuthenticationProvider daoAuthenticationProvider(UserDetailsService userDetailsService){

        DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();

        daoAuthenticationProvider.setUserDetailsService(userDetailsService);

        daoAuthenticationProvider.setPasswordEncoder(new BCryptPasswordEncoder());

        return daoAuthenticationProvider;

    }

    @Bean

    public AuthenticationManager authenticationManager(List providers){

        return new ProviderManager(providers);

    }

    @Bean

    public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {

        // WebAuthn Login

        http.apply(WebAuthnLoginConfigurer.webAuthnLogin())

                .loginPage("/login")

                .usernameParameter("username")

                .passwordParameter("rawPassword")

                .credentialIdParameter("credentialId")

                .clientDataJSONParameter("clientDataJSON")

                .authenticatorDataParameter("authenticatorData")

                .signatureParameter("signature")

                .clientExtensionsJSONParameter("clientExtensionsJSON")

                .loginProcessingUrl("/login")

                .rpId("example.com")

                .attestationOptionsEndpoint()

                .attestationOptionsProvider(attestationOptionsProvider)

                .processingUrl("/webauthn/attestation/options")

                .rp()

                .name("example")

                .and()

                .pubKeyCredParams(

                        new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256),

                        new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS1)

                )

                .authenticatorSelection()

                .authenticatorAttachment(AuthenticatorAttachment.CROSS_PLATFORM)

                .residentKey(ResidentKeyRequirement.PREFERRED)

                .userVerification(UserVerificationRequirement.PREFERRED)

                .and()

                .attestation(AttestationConveyancePreference.DIRECT)

                .extensions()

                .credProps(true)

                .uvm(true)

                .and()

                .assertionOptionsEndpoint()

                .assertionOptionsProvider(assertionOptionsProvider)

                .processingUrl("/webauthn/assertion/options")

                .rpId("example.com")

                .userVerification(UserVerificationRequirement.PREFERRED)

                .and()

                .authenticationManager(authenticationManager);

    }

}

```

## License

WebAuthn4J Spring Security is Open Source software released under the

[Apache 2.0 license](http://www.apache.org/licenses/LICENSE-2.0.html).