I wanna use my custom filter extends WebAuthnProcessingFilter

[swj9707]

Hello! I'm a Software Developer working in Korea.
When I use WebAuthn4j Spring Security Library I have a question about customizing the option of Security.
Our app has its security filter chain like this.

@Bean
@Order(0)
fun filterChainJwt( http : HttpSecurity, mvc : MvcRequestMatcher.Builder) : SecurityFilterChain {
     return http
		.securityMatcher("/api/v1/**")
		.httpBasic { basic -> basic.disable()}
		.formLogin {formLogin -> formLogin.disabled() }
		.csrf {csrf -> csrf.disable()}
		.cors {cors -> cors.configurationSource(corsConfigurationSource()}
		.sessionManagement { sessionManagement -> 
		sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS)}
		.authorizeHttpRequests {
			authorizeHttpRequests -> authorizeHttpRequests.requestMatchers(CorsUtils::isPreflightRequest).permitAll()
			.anyRequest().authenticated()
		}
		.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter::class.java)
		.addFilterBefore(jwtExceptionFilter, JwtAuthenticationFilter::class.java)
		.exceptionHandling {
			exceptionHandling -> exceptionHandling.accessDeniedHandler(customAccessDeniedhandler)
		.authenticationEntryPoint(customAuthenticationEntryPoint)
		}
	.orBuild
}

@Bean
@Order(1)
fun filterChainPublic( http : HttpSecurity, mvc : MvcRequestMatcher.Builder) : SecurityFilterChain {
     return http
		.securityMatcher("/public/**")
		.httpBasic { basic -> basic.disable()}
		.formLogin {formLogin -> formLogin.disabled() }
		.csrf {csrf -> csrf.disable()}
		.cors {cors -> cors.configurationSource(corsConfigurationSource()}
		.sessionManagement { sessionManagement -> 
		sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS)}
		.authorizeHttpRequests {
			authorizeHttpRequests -> 
			authorizeHttpRequests.anyRequest().permitAll()
		}
	.orBuild
}

In this case, I wanna handle the login process in our Controller Layer. If It impossible, I wanna add my own customized filter in my filterchain.
But It seems It doesn't have any option of customizing of authentication filter.

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    @Bean
    public WebAuthnAuthenticationProvider webAuthnAuthenticationProvider(WebAuthnAuthenticatorService authenticatorService, WebAuthnManager webAuthnManager){
        return new WebAuthnAuthenticationProvider(authenticatorService, webAuthnManager);
    }

    @Bean
    public DaoAuthenticationProvider daoAuthenticationProvider(UserDetailsService userDetailsService){
        DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
        daoAuthenticationProvider.setUserDetailsService(userDetailsService);
        daoAuthenticationProvider.setPasswordEncoder(new BCryptPasswordEncoder());
        return daoAuthenticationProvider;
    }

    @Bean
    public AuthenticationManager authenticationManager(List<AuthenticationProvider> providers){
        return new ProviderManager(providers);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
        // WebAuthn Login
        http.apply(WebAuthnLoginConfigurer.webAuthnLogin())
                .loginPage("/login")
                .usernameParameter("username")
                .passwordParameter("rawPassword")
                .credentialIdParameter("credentialId")
                .clientDataJSONParameter("clientDataJSON")
                .authenticatorDataParameter("authenticatorData")
                .signatureParameter("signature")
                .clientExtensionsJSONParameter("clientExtensionsJSON")
                .loginProcessingUrl("/login")
                .rpId("example.com")
                .attestationOptionsEndpoint()
                .attestationOptionsProvider(attestationOptionsProvider)
                .processingUrl("/webauthn/attestation/options")
                .rp()
                .name("example")
                .and()
                .pubKeyCredParams(
                        new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.ES256),
                        new PublicKeyCredentialParameters(PublicKeyCredentialType.PUBLIC_KEY, COSEAlgorithmIdentifier.RS1)
                )
                .authenticatorSelection()
                .authenticatorAttachment(AuthenticatorAttachment.CROSS_PLATFORM)
                .residentKey(ResidentKeyRequirement.PREFERRED)
                .userVerification(UserVerificationRequirement.PREFERRED)
                .and()
                .attestation(AttestationConveyancePreference.DIRECT)
                .extensions()
                .credProps(true)
                .uvm(true)
                .and()
                .assertionOptionsEndpoint()
                .assertionOptionsProvider(assertionOptionsProvider)
                .processingUrl("/webauthn/assertion/options")
                .rpId("example.com")
                .userVerification(UserVerificationRequirement.PREFERRED)
                .and()
                .authenticationManager(authenticationManager);
    }
}

I know how to change loginProcessUrl But I don't know how to change login Process filter.
How can I setup configuration in this case?

[ynojima]

When you use WebAuthnLoginConfigurer.webAuthnLogin(), WebAuthnProcessingFilter is registered by WebAuthnLoginConfigurer(more precisely its super class AbstractAuthenticationFilterConfigurer),
https://github.com/spring-projects/spring-security/blob/main/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractAuthenticationFilterConfigurer.java#L302
but you may instantiate WebAuthnProcessingFilter and register it at your favorite order by yourself.

[swj9707]

It seems setAuthenticationFilter, registerAuthenticationEntryPoint method's ard protected. If I understand correctly, it seems that these instances can be registered as addFilterBefore when I register the filter chain. If I do that, is it correct that the filters registered in webAuthnLoginConfigurer are overwritten?