WebAuthnRegistrationRequestValidator { public WebAuthnRegistrationRequestValidationResponse validate(HttpServletRequest httpServletRequest, String clientDataBase64url, String attestationObjectBase64url, Set<String> transports, String clientExtensionsJSON ) { Assert.notNull(httpServletRequest, "httpServletRequest must not be null"); Assert.hasText(clientDataBase64url, "clientDataBase64url must have text"); Assert.hasText(attestationObjectBase64url, "attestationObjectBase64url must have text"); if (transports != null) { transports.forEach(transport -> Assert.hasText(transport, "each transport must have text")); } RegistrationRequest webAuthnRegistrationRequest = createRegistrationRequest(clientDataBase64url, attestationObjectBase64url, transports, clientExtensionsJSON); RegistrationParameters webAuthnRegistrationParameters = createRegistrationParameters(httpServletRequest); try { RegistrationData response = webAuthnManager.validate(webAuthnRegistrationRequest, webAuthnRegistrationParameters); return new WebAuthnRegistrationRequestValidationResponse( response.getCollectedClientData(), response.getAttestationObject(), response.getClientExtensions(), response.getTransports()); } catch (WebAuthnException e) { throw ExceptionUtil.wrapWithAuthenticationException(e); } } WebAuthnRegistrationRequestValidator(WebAuthnManager webAuthnManager, ServerPropertyProvider serverPropertyProvider); WebAuthnRegistrationRequestValidationResponse validate(HttpServletRequest httpServletRequest,
                                                                  String clientDataBase64url,
                                                                  String attestationObjectBase64url,
                                                                  Set<String> transports,
                                                                  String clientExtensionsJSON
    );  }
@Test public void validate_test() { WebAuthnRegistrationRequestValidator target = new WebAuthnRegistrationRequestValidator( webAuthnManager, serverPropertyProvider ); ServerProperty serverProperty = mock(ServerProperty.class); when(serverPropertyProvider.provide(any())).thenReturn(serverProperty); CollectedClientData collectedClientData = mock(CollectedClientData.class); AttestationObject attestationObject = mock(AttestationObject.class); AuthenticationExtensionsClientOutputs<RegistrationExtensionClientOutput> clientExtensionOutputs = new AuthenticationExtensionsClientOutputs<>(); when(webAuthnManager.validate(any(RegistrationRequest.class), any(RegistrationParameters.class))).thenReturn( new RegistrationData(attestationObject, null, collectedClientData, null, clientExtensionOutputs, null)); MockHttpServletRequest mockHttpServletRequest = new MockHttpServletRequest(); mockHttpServletRequest.setScheme("https"); mockHttpServletRequest.setServerName("example.com"); mockHttpServletRequest.setServerPort(443); String clientDataBase64 = "clientDataBase64"; String attestationObjectBase64 = "attestationObjectBase64"; Set<String> transports = Collections.emptySet(); String clientExtensionsJSON = "clientExtensionsJSON"; target.validate(mockHttpServletRequest, clientDataBase64, attestationObjectBase64, transports, clientExtensionsJSON); ArgumentCaptor<RegistrationRequest> registrationRequestArgumentCaptor = ArgumentCaptor.forClass(RegistrationRequest.class); ArgumentCaptor<RegistrationParameters> registrationParametersArgumentCaptor = ArgumentCaptor.forClass(RegistrationParameters.class); verify(webAuthnManager).validate(registrationRequestArgumentCaptor.capture(), registrationParametersArgumentCaptor.capture()); RegistrationRequest registrationRequest = registrationRequestArgumentCaptor.getValue(); RegistrationParameters registrationParameters = registrationParametersArgumentCaptor.getValue(); assertThat(registrationRequest.getClientDataJSON()).isEqualTo(Base64UrlUtil.decode(clientDataBase64)); assertThat(registrationRequest.getAttestationObject()).isEqualTo(Base64UrlUtil.decode(attestationObjectBase64)); assertThat(registrationRequest.getClientExtensionsJSON()).isEqualTo(clientExtensionsJSON); assertThat(registrationParameters.getServerProperty()).isEqualTo(serverProperty); }
@Test public void validate_with_transports_null_test() { WebAuthnRegistrationRequestValidator target = new WebAuthnRegistrationRequestValidator( webAuthnManager, serverPropertyProvider ); ServerProperty serverProperty = mock(ServerProperty.class); when(serverPropertyProvider.provide(any())).thenReturn(serverProperty); CollectedClientData collectedClientData = mock(CollectedClientData.class); AttestationObject attestationObject = mock(AttestationObject.class); AuthenticationExtensionsClientOutputs<RegistrationExtensionClientOutput> clientExtensionOutputs = new AuthenticationExtensionsClientOutputs<>(); when(webAuthnManager.validate(any(RegistrationRequest.class), any(RegistrationParameters.class))).thenReturn( new RegistrationData(attestationObject, null, collectedClientData, null, clientExtensionOutputs, null)); MockHttpServletRequest mockHttpServletRequest = new MockHttpServletRequest(); mockHttpServletRequest.setScheme("https"); mockHttpServletRequest.setServerName("example.com"); mockHttpServletRequest.setServerPort(443); String clientDataBase64 = "clientDataBase64"; String attestationObjectBase64 = "attestationObjectBase64"; String clientExtensionsJSON = "clientExtensionsJSON"; target.validate(mockHttpServletRequest, clientDataBase64, attestationObjectBase64, null, clientExtensionsJSON); ArgumentCaptor<RegistrationRequest> registrationRequestArgumentCaptor = ArgumentCaptor.forClass(RegistrationRequest.class); ArgumentCaptor<RegistrationParameters> registrationParametersArgumentCaptor = ArgumentCaptor.forClass(RegistrationParameters.class); verify(webAuthnManager).validate(registrationRequestArgumentCaptor.capture(), registrationParametersArgumentCaptor.capture()); RegistrationRequest registrationRequest = registrationRequestArgumentCaptor.getValue(); RegistrationParameters registrationParameters = registrationParametersArgumentCaptor.getValue(); assertThat(registrationRequest.getClientDataJSON()).isEqualTo(Base64UrlUtil.decode(clientDataBase64)); assertThat(registrationRequest.getAttestationObject()).isEqualTo(Base64UrlUtil.decode(attestationObjectBase64)); assertThat(registrationRequest.getClientExtensionsJSON()).isEqualTo(clientExtensionsJSON); assertThat(registrationParameters.getServerProperty()).isEqualTo(serverProperty); }
@Test(expected = BadAttestationStatementException.class) public void validate_caught_exception_test() { WebAuthnRegistrationRequestValidator target = new WebAuthnRegistrationRequestValidator( webAuthnManager, serverPropertyProvider ); when(webAuthnManager.validate(any(RegistrationRequest.class), any(RegistrationParameters.class))).thenThrow(new com.webauthn4j.validator.exception.BadAttestationStatementException("dummy")); MockHttpServletRequest mockHttpServletRequest = new MockHttpServletRequest(); mockHttpServletRequest.setScheme("https"); mockHttpServletRequest.setServerName("example.com"); mockHttpServletRequest.setServerPort(443); String clientDataBase64 = "clientDataBase64"; String attestationObjectBase64 = "attestationObjectBase64"; Set<String> transports = Collections.emptySet(); String clientExtensionsJSON = "clientExtensionsJSON"; target.validate(mockHttpServletRequest, clientDataBase64, attestationObjectBase64, transports, clientExtensionsJSON); }