From 66fee6afd779de514dba1951cf5ed4cc91a24fff Mon Sep 17 00:00:00 2001 From: Ziqin Wang Date: Wed, 18 Mar 2026 23:43:25 +0800 Subject: [PATCH] Fix missing session fixation protection for WebAuthn Closes gh-18931 Signed-off-by: Ziqin Wang --- .../config/annotation/web/configurers/WebAuthnConfigurer.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/WebAuthnConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/WebAuthnConfigurer.java index b1c3ce32bfe..261e9164665 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/WebAuthnConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/WebAuthnConfigurer.java @@ -28,6 +28,7 @@ import org.springframework.security.config.annotation.web.HttpSecurityBuilder; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.web.access.intercept.AuthorizationFilter; +import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy; import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter; import org.springframework.security.web.authentication.ui.DefaultResourcesFilter; import org.springframework.security.web.authentication.www.BasicAuthenticationFilter; @@ -164,6 +165,7 @@ public void configure(H http) throws Exception { WebAuthnAuthenticationFilter webAuthnAuthnFilter = new WebAuthnAuthenticationFilter(); webAuthnAuthnFilter.setAuthenticationManager( new ProviderManager(new WebAuthnAuthenticationProvider(rpOperations, userDetailsService))); + webAuthnAuthnFilter.setSessionAuthenticationStrategy(http.getSharedObject(SessionAuthenticationStrategy.class)); WebAuthnRegistrationFilter webAuthnRegistrationFilter = new WebAuthnRegistrationFilter(userCredentials, rpOperations); PublicKeyCredentialCreationOptionsFilter creationOptionsFilter = new PublicKeyCredentialCreationOptionsFilter(