Description
Expected Behavior
I expect to be able to provide my own implementations for PublicKeyCredentialCreationOptionsRepository and HttpMessageConverter when using passkeys/webauthn, specifically to be able to save/load the options outside of a session.
e.g.,
@Bean
SecurityFilterChain webAuthnFilterChain(HttpSecurity http) throws Exception {
return http.webAuthn(webAuthn -> { ... }).build();
}
@Bean
B2cPublicKeyCredentialCreationOptionsRepository customCreationOptionsRepo() {
return new MyCustomB2cPublicKeyCredentialCreationOptionsRepository();
}
Current Behavior
The webauthn filters just initialize their own instances on construction:
https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/webauthn/registration/PublicKeyCredentialCreationOptionsFilter.java#L59
WebAuthnRegistrationFilter at least has a setter to update it, but I'd have to use reflection to update PublicKeyCredentialCreationOptionsFilter.
Context
I have another server forwarding the webauthn requests to a spring boot server, and will be storing the state externally and not in a session. My current workaround is to use reflection to update the private fields to use my implementation of B2cPublicKeyCredentialCreationOptionsRepository, but I feel that dependencies should be injected so they can be customized.