Ankur Mhatre
f6dd692177
Fourth Maven project in the repository. Registration and authentication run end to end with no browser and no hardware key: VirtualAuthenticator emits real CBOR attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java drives the live HTTP endpoints with them. Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.
85 lines
3.1 KiB
XML
85 lines
3.1 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<parent>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-parent</artifactId>
|
|
<version>4.1.1</version>
|
|
<relativePath/>
|
|
</parent>
|
|
|
|
<groupId>com.ankurm</groupId>
|
|
<artifactId>passkeys-demo</artifactId>
|
|
<version>1.0.0</version>
|
|
<name>passkeys-demo</name>
|
|
<description>Passkeys and WebAuthn with Spring Security 7.1 on Spring Boot 4.1 - runnable companion for ankurm.com</description>
|
|
|
|
<!--
|
|
One application, port 8080, rpId "localhost".
|
|
|
|
The interesting part of this module is that it needs no browser. tools/PasskeyCeremony.java
|
|
drives the real HTTP endpoints (/webauthn/register/options, /webauthn/register,
|
|
/webauthn/authenticate/options, /login/webauthn) using a software authenticator that
|
|
produces genuine CBOR attestation objects and genuine ES256 assertion signatures -
|
|
see src/main/java/com/ankurm/passkeys/virtual/VirtualAuthenticator.java and
|
|
docs/passkeys/04-virtual-authenticator.md.
|
|
|
|
spring-security-webauthn is NOT part of spring-boot-starter-security. As of Spring
|
|
Security 7.0 the WebAuthn classes live in their own artifact; in 6.4 and 6.5 they were
|
|
inside spring-security-web. See docs/passkeys/01-versions.md.
|
|
-->
|
|
<properties>
|
|
<java.version>25</java.version>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
</properties>
|
|
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-web</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-security</artifactId>
|
|
</dependency>
|
|
<!-- The one dependency the passkey docs are easy to miss. Version managed by Boot. -->
|
|
<dependency>
|
|
<groupId>org.springframework.security</groupId>
|
|
<artifactId>spring-security-webauthn</artifactId>
|
|
</dependency>
|
|
<!-- Only used by the "jdbc" profile, to show what JDBC persistence actually requires. -->
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-jdbc</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.h2database</groupId>
|
|
<artifactId>h2</artifactId>
|
|
<scope>runtime</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-test</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.security</groupId>
|
|
<artifactId>spring-security-test</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-maven-plugin</artifactId>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</project>
|