Skip to content

WebAuthn: credential registration fails with an unknown credential type error #17164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ltanguy opened this issue May 23, 2025 · 3 comments · May be fixed by #17223
Open

WebAuthn: credential registration fails with an unknown credential type error #17164

ltanguy opened this issue May 23, 2025 · 3 comments · May be fixed by #17223
Labels
status: waiting-for-triage An issue we've not yet triaged type: bug A general bug

Comments

@ltanguy
Copy link

ltanguy commented May 23, 2025

Describe the bug
When following the steps described in the documentation, the credential registration fails with the following exception:
java.lang.IllegalArgumentException: Cannot convert unknown credential type org.springframework.security.web.webauthn.api.PublicKeyCredentialType@4cfbb790 to webauthn4j

Expected behavior
The problem seems to originate from this line.
The debugger indicates that the type of the request I generate is indeed "public-key", but as the two object instances are different this test fails.
The error message could be clearer by referencing the value of the PublicKeyCredentialType object

@ltanguy ltanguy added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels May 23, 2025
@ngocnhan-tran1996
Copy link
Contributor

Could you please provide a sample?

@ltanguy
Copy link
Author

ltanguy commented May 26, 2025

Update: Simple app reproducing the issue.

This bug is triggered in my setup by the fact that the session is stored in database through spring session.

The following code makes the assumption that PublicKeyCrendentialType is an enum (which it is not):
if (parameter.getType() != PublicKeyCredentialType.PUBLIC_KEY) {
This test should be based on .equals().
This problem was not directly triggered in simple applications as we only rely on one single instance of PublicKeyCredentialType.
With Spring Session JDBC, the HTTP session is constructed for each request and thus uses new instances of this object, making this test fail.

@ltanguy
Copy link
Author

ltanguy commented May 26, 2025

As a side note, PublicKeyCredentialCreationOptions is not declared as Serializable (contrary to the other classes in this package). This makes this authentication method not compatible with a vanilla Spring Session installation that relies on the default Java object serializer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-triage An issue we've not yet triaged type: bug A general bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants