Error is reported when calling other interfaces after successful login 403 Forbidden

[asfdnkw]

I have successfully logged in. Verified by webauthn. But calling other interfaces will result in error 403 Forbidden

[asfdnkw]

I haven't changed anything. I tried logging in again and the findAll request was approved. But findLockGroup did not. By the way, let me mention. FindAll is a post request. findLockGroup is a get request

[asfdnkw]

After logging in, click to refresh the interface. The same mistake will occur later. http://localhost:8222/user It's my routing interface

[asfdnkw]

I hit a breakpoint 。Call other interfaces after successful login. Discovered that it was not called

[asfdnkw]

I typed a System. out. println() output statement in getWebExpressionAuthorityManager mehtod. There is also no output

[ynojima]

getWebExpressionAuthorityManager is called at the application boot phase. Not during the request processing phase.
You need to put a breakpoint inside of WebAuthnSecurityExpression#isWebAuthnAuthenticated method.

[asfdnkw]

yes. When I call the login interface. The result of this breakpoint is as follows

[asfdnkw]

[asfdnkw]

I have registered another user named testRole with the permission of SINGLE-FACTOR_ AUTHN_ALOWED. However, the current errors still occur

[asfdnkw]

After I log in, I call other interfaces and return false

[asfdnkw]

! image
I seem to have identified the issue at hand. I have customized one AccountAuthenticationProvider implements AuthenticationProvider
One of them, 'authenticate', will return my custom Accountant Authentication Token.
After logging in, it will be judged by WebAuthnSecurityExpression # isWebAuthenticated

[asfdnkw]

Is that what I said? Can you give me some advice

[asfdnkw]

How can I obtain the contents of WebAuthnAuthenticationToken after successful login

[ynojima]

I seem to have identified the issue at hand. I have customized one AccountAuthenticationProvider implements AuthenticationProvider
One of them, 'authenticate', will return my custom Accountant Authentication Token.
After logging in, it will be judged by WebAuthnSecurityExpression # isWebAuthenticated

Good! That's the cause. webauthn4j-spring-security provides WebAuthnAuthenticationProvider and WebAuthnSecurityExpression#isWebAuthenticated expects WebAuthnAuthenticationProvider emits WebAuthnAuthenticationToken,
but in your application, it seems your AccountAuthenticationProvider emits UsernamePasswordAuthenticationToken. That's why WebAuthnSecurityExpression#isWebAuthenticated returns false.

You need to use WebAuthnAuthenticationProvider instead of your AccountAuthenticationProvider to consume WebAuthnAssertionAuthenticationToken because WebAuthnAuthenticationProvider is the class verifies the WebAuthn assertion. WebAuthnProcessingFilter doesn't verifies the WebAuthn assertion.

webauthn4j-spring-security/webauthn4j-spring-security-core/src/main/java/com/webauthn4j/springframework/security/WebAuthnAuthenticationProvider.java

Lines 126 to 148 in fa0ac0a

	WebAuthnAuthenticationRequest request = authenticationToken.getCredentials();
	WebAuthnAuthenticationParameters parameters = authenticationToken.getParameters();
	AuthenticationRequest authenticationRequest = new AuthenticationRequest(
	request.getCredentialId(),
	request.getAuthenticatorData(),
	request.getClientDataJSON(),
	request.getClientExtensionsJSON(),
	request.getSignature()
	);
	AuthenticationParameters authenticationParameters = new AuthenticationParameters(
	parameters.getServerProperty(),
	webAuthnCredentialRecord,
	null,
	parameters.isUserVerificationRequired(),
	parameters.isUserPresenceRequired()
	);
	try {
	webAuthnManager.verify(authenticationRequest, authenticationParameters);
	} catch (WebAuthnException e) {
	throw ExceptionUtil.wrapWithAuthenticationException(e);
	}

If you need to emit your custom "Authentication Token" from the AuthenticationProvider, you may create sub-class of WebAuthnAuthenticationProvider and override WebAuthnAuthenticationProvider#createSuccessAuthentication.