Skip to content

chore: update java-webauthn-server to 2.9.0 and apply upstream fixes #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
elukewalker wants to merge 6 commits into from
Closed

chore: update java-webauthn-server to 2.9.0 and apply upstream fixes #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5efdd6c
chore: update java-webauthn-server to 2.9.0 and apply upstream fixes
May 12, 2026
d8cb358
docs: fix README issues from PR review
May 13, 2026
ed2961a
fix: address code review findings - update JUnit, Docker, scripts, an…
May 13, 2026
4ce7328
fix: complete 2.x migration - remove attestation dependency and updat…
May 13, 2026
dea4cfd
docs: complete 2.x migration - remove deprecated features and fix run…
May 13, 2026
1845d58
docs: add CHANGELOG documenting java-webauthn-server 2.9.0 migration
May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions 1_Getting_Started/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,10 @@ This section outlines the prerequisites to complete the workshop and instruction
## Prerequisites
In order to complete this workshop you will need a development environment with the following:
* [Git](https://git-scm.com/)
* [JDK 1.8](https://www.oracle.com/technetwork/java/javase/downloads/index.html) or later
* [JDK 17](https://www.oracle.com/technetwork/java/javase/downloads/index.html) or later
* [Maven 3.2](https://maven.apache.org/download.cgi)+
* FIDO2 compatible platform / browser
* MacOS: [Safari Technical Preview](https://developer.apple.com/safari/technology-preview/) version 71+
* Windows 10 Version 1809+: Edge
* Chrome 67+, Firefox 60+, Safari 14+, or Edge (all modern browsers support WebAuthn natively)
* A favorite text editor or IDE
* A security key

Expand Down
4 changes: 2 additions & 2 deletions 1_Getting_Started/complete/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@ FROM alpine/git as clone
WORKDIR /app
RUN git clone https://github.com/YubicoLabs/java-webauthn-passwordless-workshop.git

FROM maven:3.5-jdk-8-alpine as build
FROM maven:3.9-eclipse-temurin-17-alpine as build
WORKDIR /app
COPY --from=clone /app/java-webauthn-passwordless-workshop/initial /app
RUN mvn clean package

FROM openjdk:8-jre-alpine
FROM eclipse-temurin:17-jre-alpine
VOLUME /tmp
WORKDIR /app
COPY --from=build /app/target/demo-0.0.1-SNAPSHOT.jar /app
Expand Down
22 changes: 8 additions & 14 deletions 2_Credential_Repository/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,25 +50,24 @@ Windows 10 example of multiple credentials on a security key. The top choice is


### Dependency configuration
Open the ```pom.xml``` and add the webauthn-server-core and webauthn-server-attestation dependencies. The workshop is known to work with version 1.2.0 of the java-webauthn-server.
Open the ```pom.xml``` and add the webauthn-server-core dependency. The workshop is known to work with version 2.9.0 of the java-webauthn-server.
```xml
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.2.3</version>
<version>1.2.13</version>
</dependency>
<dependency>
<groupId>com.yubico</groupId>
<artifactId>webauthn-server-core</artifactId>
<!--Check for the latest version at Maven Central-->
<version>1.2.0</version>
<version>2.9.0</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>com.yubico</groupId>
<artifactId>webauthn-server-attestation</artifactId>
<!--Check for the latest version at Maven Central-->
<version>1.2.0</version>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>32.1.3-jre</version>
<scope>compile</scope>
</dependency>
```
Expand All @@ -88,7 +87,7 @@ We will be using some resources from the webauthn-server-demo in our project.
2. Open `getLibs.sh` or `getLibs.ps1` in your editor take a look at what it does
1. First it clones the java-webauthn-server repo
2. Next the webauthn-server-demo data and yubico packages are copied to the project
3. Then the AuthenticatedAction, Config, InMemoryRegistrationStorage, and RegistrationStorage, preview metadata, lib, and js content are copied to the project
3. Then the AuthenticatedAction, Config, InMemoryRegistrationStorage, and RegistrationStorage, lib, and js content are copied to the project
4. Finally, the webauthn-server-demo package names and renamed to match our project structure. Some of the java files that were copied over had an incorrect package name. For each file we replace 'demo.webauthn' with 'com.example.demo'.
3. Run the getLibs script

Expand Down Expand Up @@ -144,11 +143,6 @@ the server will report. Example: `YUBICO_WEBAUTHN_RP_ID=demo.yubico.com`
the server will report. Example: `YUBICO_WEBAUTHN_RP_ID='Yubico Web
Authentication demo'`

- `YUBICO_WEBAUTHN_RP_ICON`: An optional URL to an
[icon](https://www.w3.org/TR/webauthn/#dom-publickeycredentialentity-icon) to
represent this Relying Party. Example:
`YUBICO_WEBAUTHN_RP_ICON='https://www.yubico.com/wp-content/uploads/2014/09/favicon.ico'`

**InMemoryRegistrationStorage.java**

The `InMemoryRegistrationStorage` implements the `RegistrationStorage` and `CredentialRepository` interfaces and stores credential registrations in memory.
Expand All @@ -173,7 +167,7 @@ The `js` and `lib` folders contain javascript libraries which help process the W

**preview-metadata.json**

The `preview-metadata.json` stores metadata for known/trusted authenticators.
The `preview-metadata.json` file is included for legacy compatibility but is no longer used by java-webauthn-server 2.x. Attestation metadata features were removed in version 2.0.

</p></details>

Expand Down
4 changes: 2 additions & 2 deletions 2_Credential_Repository/complete/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@ FROM alpine/git as clone
WORKDIR /app
RUN git clone https://github.com/YubicoLabs/java-webauthn-passwordless-workshop.git

FROM maven:3.5-jdk-8-alpine as build
FROM maven:3.9-eclipse-temurin-17-alpine as build
WORKDIR /app
COPY --from=clone /app/java-webauthn-passwordless-workshop/2_Credential_Repository/complete /app
RUN mvn clean package

FROM openjdk:8-jre-alpine
FROM eclipse-temurin:17-jre-alpine
VOLUME /tmp
WORKDIR /app
COPY --from=build /app/target/demo-0.0.1-SNAPSHOT.jar /app
Expand Down
2 changes: 1 addition & 1 deletion 2_Credential_Repository/complete/getLibs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ cd tmp
git clone https://github.com/Yubico/java-webauthn-server.git

git fetch https://github.com/Yubico/java-webauthn-server.git
git -C java-webauthn-server checkout tags/1.2.0
git -C java-webauthn-server checkout tags/2.9.0

# Copy the webauthn-server-demo data package to the project
cp -r java-webauthn-server/webauthn-server-demo/src/main/java/demo/webauthn/data ../src/main/java/com/example/demo
Expand Down
18 changes: 8 additions & 10 deletions 2_Credential_Repository/complete/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.1.4.RELEASE</version>
<version>2.7.18</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.example</groupId>
Expand All @@ -15,7 +15,7 @@
<description>Demo project for Spring Boot</description>

<properties>
<java.version>1.8</java.version>
<java.version>17</java.version>
</properties>

<dependencies>
Expand Down Expand Up @@ -55,21 +55,19 @@
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.2.3</version>
<version>1.2.13</version>
</dependency>
<dependency>
<groupId>com.yubico</groupId>
<artifactId>webauthn-server-core</artifactId>
<!--Check for the latest version at Maven Central-->
<version>1.2.0</version>
<version>2.9.0</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>com.yubico</groupId>
<artifactId>webauthn-server-attestation</artifactId>
<!--Check for the latest version at Maven Central-->
<version>1.2.0</version>
<scope>compile</scope>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>32.1.3-jre</version>
</dependency>
</dependencies>

Expand Down Expand Up @@ -120,7 +118,7 @@
<region>${REGION}</region> <!--e.g. centralus -->

<!-- Java Runtime Stack for Web App on Linux-->
<linuxRuntime>jre8</linuxRuntime>
<linuxRuntime>java17</linuxRuntime>
</configuration>
</plugin>
<plugin>
Expand Down
15 changes: 4 additions & 11 deletions 2_Credential_Repository/complete/src/main/java/com/example/demo/Config.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@

package com.example.demo;

import com.yubico.internal.util.CollectionUtil;
import com.yubico.webauthn.data.RelyingPartyIdentity;
import com.yubico.webauthn.extension.appid.AppId;
import com.yubico.webauthn.extension.appid.InvalidAppIdException;
Expand Down Expand Up @@ -53,7 +52,7 @@ public class Config {
private final Optional<AppId> appId;

private Config(Set<String> origins, int port, RelyingPartyIdentity rpIdentity, Optional<AppId> appId) {
this.origins = CollectionUtil.immutableSet(origins);
this.origins = Collections.unmodifiableSet(new HashSet<>(origins));
this.port = port;
this.rpIdentity = rpIdentity;
this.appId = appId;
Expand Down Expand Up @@ -140,15 +139,9 @@ private static RelyingPartyIdentity computeRpIdentity() throws MalformedURLExcep
resultBuilder.id(id);
}

if (icon == null) {
logger.debug("RP icon not given - using none.");
} else {
try {
resultBuilder.icon(Optional.of(new URL(icon)));
} catch (MalformedURLException e) {
logger.error("Invalid icon URL: {}", icon, e);
throw e;
}
// Note: icon property was removed in webauthn-server-core 2.x
if (icon != null) {
logger.warn("RP icon property is no longer supported in webauthn-server-core 2.x and will be ignored");
}

final RelyingPartyIdentity result = resultBuilder.build();
Expand Down
4 changes: 2 additions & 2 deletions ...ntial_Repository/complete/src/main/java/com/example/demo/InMemoryRegistrationStorage.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,14 @@

import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import com.yubico.internal.util.CollectionUtil;
import com.yubico.webauthn.AssertionResult;
import com.yubico.webauthn.CredentialRepository;
import com.yubico.webauthn.RegisteredCredential;
import com.yubico.webauthn.data.ByteArray;
import com.yubico.webauthn.data.PublicKeyCredentialDescriptor;
import com.example.demo.data.CredentialRegistration;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.NoSuchElementException;
import java.util.Optional;
Expand Down Expand Up @@ -171,7 +171,7 @@ public Optional<RegisteredCredential> lookup(ByteArray credentialId, ByteArray u

@Override
public Set<RegisteredCredential> lookupAll(ByteArray credentialId) {
return CollectionUtil.immutableSet(
return Collections.unmodifiableSet(
storage.asMap().values().stream()
.flatMap(Collection::stream)
.filter(reg -> reg.getCredential().getCredentialId().equals(credentialId))
Expand Down
Loading