405 Method Not Allowed

[asfdnkw]

I set it loginProcessingURL ("/app/authn/login") up. And ("/app/authn/login") .requestMatchers(HttpMethod.POST,"/api/authn/login").permitAll()
But make sure it's wrong 405 Method Not Allowed

[ynojima]

It seems the request is not caught by WebAuthnProcessingFilter. Please share how you defined SecurityFilterChain bean like:

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {

        http.authenticationManager(authenticationManager);
        // WebAuthn Login
        http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
            customizer
                    .usernameParameter("username")
                    .passwordParameter("password")
                    .credentialIdParameter("credentialId")
                    .clientDataJSONParameter("clientDataJSON")
                    .authenticatorDataParameter("authenticatorData")
                    .signatureParameter("signature")
                    .clientExtensionsJSONParameter("clientExtensionsJSON")
                    .loginProcessingUrl("/login")
                    .attestationOptionsEndpoint()
                    .rp()
                        .name("WebAuthn4J Spring Security Sample")
                    .and()
                    .pubKeyCredParams(
                            new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS256), // Windows Hello
                            new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256) // FIDO U2F Key, etc
                    )
                    .extensions()
                        .credProps(true)
                    .and()
                    .assertionOptionsEndpoint()
                    .and()
                    .successHandler(authenticationSuccessHandler)
                    .failureHandler(authenticationFailureHandler);
        });

[asfdnkw]

@Bean
public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {

    http.authenticationManager(authenticationManager);
    // WebAuthn Login
    http.with(WebAuthnLoginConfigurer.webAuthnLogin(), (customizer) ->{
        customizer
                .usernameParameter("username")
                .credentialIdParameter("credentialId")
                .clientDataJSONParameter("clientDataJSON")
                .authenticatorDataParameter("authenticatorData")
                .signatureParameter("signature")
                .clientExtensionsJSONParameter("clientExtensionsJSON")
                .loginProcessingUrl("/api/public/login2")
                .attestationOptionsEndpoint()
                .rp()
                .name("WebAuthn4J Spring Security Sample")
                .and()
                .pubKeyCredParams(
                        new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS256), // Windows Hello
                        new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256) // FIDO U2F Key, etc
                )
                .extensions()
                .credProps(true)
                .and()
                .assertionOptionsEndpoint()
                .and()
                .successHandler(authenticationSuccessHandler)
                .failureHandler(authenticationFailureHandler);
    });


    // Authorization
    http.authorizeHttpRequests(authz -> authz
            .requestMatchers("/").permitAll()
            .requestMatchers(HttpMethod.POST,"/api/public/login2").permitAll()
            .requestMatchers("/static/**").permitAll()
            .requestMatchers("/assets/**", "/css/**", "/js/**").permitAll()
            .requestMatchers("/index.html").permitAll()
            .requestMatchers("/resources/static/**").permitAll()
            .requestMatchers("/static/**").permitAll()
            .requestMatchers("/webjars/**").permitAll()
            .requestMatchers("/favicon.ico").permitAll()
            .requestMatchers("/api/auth/status").permitAll()
            .requestMatchers("/api/profile").permitAll()
            .requestMatchers("/api/status/**").permitAll()
            .requestMatchers("/health/**").permitAll()
            .requestMatchers("/info/**").permitAll()
            .requestMatchers("/api/public/signup").permitAll()
            .requestMatchers("/api/public/login").permitAll()
            .anyRequest().access(getWebExpressionAuthorizationManager("@webAuthnSecurityExpression.isWebAuthnAuthenticated(authentication) || hasAuthority('SINGLE_FACTOR_AUTHN_ALLOWED')"))

    );

    http.addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    // Logout
    http.logout(customizer -> {
        customizer.logoutUrl("/logout");
        customizer.logoutSuccessHandler(logoutSuccessHandler);
    });

    http.sessionManagement(customizer -> customizer.sessionAuthenticationFailureHandler(authenticationFailureHandler));

    http.exceptionHandling(customizer -> {
        customizer.authenticationEntryPoint(authenticationEntryPoint);
        customizer.accessDeniedHandler(accessDeniedHandler);
    });

    // As WebAuthn has its own CSRF protection mechanism (challenge), CSRF token is disabled here
    CsrfTokenRequestAttributeHandler csrfTokenRequestAttributeHandler = new CsrfTokenRequestAttributeHandler();
    csrfTokenRequestAttributeHandler.setCsrfRequestAttributeName(null);
    http.csrf(customizer ->{
        customizer.csrfTokenRequestHandler(csrfTokenRequestAttributeHandler);
        customizer.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        customizer.ignoringRequestMatchers("/webauthn/**");
        customizer.ignoringRequestMatchers("/static/**");
        customizer.ignoringRequestMatchers("/assets/**");
        customizer.ignoringRequestMatchers("/css/**");
        customizer.ignoringRequestMatchers("/js/**");
        customizer.ignoringRequestMatchers("index.html");
        customizer.ignoringRequestMatchers("/login");
        customizer.ignoringRequestMatchers("/api/public/login2");
        customizer.ignoringRequestMatchers("/api/public/login");
    });

    return http.build();
}

[ynojima]

Chrome Dev Tools shows the request is sent to /api/public/login, but the code indicates it listens /api/public/login2. Did you changed the config after taking the screen shot?
Other than that, I cannot find issues on this config.

Could you put a breakpoint on the WebAuthnProcessingFilter#attemptAuthentication to check the request is arrived to the WebAuthnProcessingFilter? Also, could you put a breakpoint on the constructor of the WebAuthnProcessingFilter to check it is initialized?

[asfdnkw]

WebAuthnProcessingFilter has been initialized. But the breakpoint was not reached when sending the request. Yes, my configuration has been changed

[asfdnkw]

I have rewritten another demo. The same configuration yielded a result of 200. Perhaps some of the code in my program was written incorrectly. I am trying to create a branch to rewrite and integrate webauthn

[asfdnkw]

This is my front-end post request.