diff --git a/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java b/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java
index 407a055d42..244ba13dcd 100644
--- a/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java
+++ b/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
+import java.time.Duration;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Collection;
@@ -170,9 +171,21 @@
import org.springframework.security.web.csrf.MissingCsrfTokenException;
import org.springframework.security.web.firewall.RequestRejectedException;
import org.springframework.security.web.server.firewall.ServerExchangeRejectedException;
+import org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientInputs;
+import org.springframework.security.web.webauthn.api.AuthenticatorTransport;
+import org.springframework.security.web.webauthn.api.Bytes;
+import org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput;
+import org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInput;
+import org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs;
+import org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor;
+import org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions;
+import org.springframework.security.web.webauthn.api.PublicKeyCredentialType;
+import org.springframework.security.web.webauthn.api.UserVerificationRequirement;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;
+import static org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput.*;
+import static org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput.CredProtect.ProtectionPolicy.*;
/**
* Tests that Spring Security classes that implements {@link Serializable} and have the
@@ -322,6 +335,38 @@ class SpringSecurityCoreVersionSerializableTests {
generatorByClassName.put(OAuth2IntrospectionException.class,
(r) -> new OAuth2IntrospectionException("message", new RuntimeException()));
+ //webauthn
+ CredProtect credProtect = new CredProtect(USER_VERIFICATION_OPTIONAL, true);
+ Bytes id = new Bytes(("test").getBytes());
+ AuthenticationExtensionsClientInputs inputs = new ImmutableAuthenticationExtensionsClientInputs(ImmutableAuthenticationExtensionsClientInput.credProps);
+ // @formatter:off
+ PublicKeyCredentialDescriptor descriptor = PublicKeyCredentialDescriptor.builder()
+ .id(id)
+ .type(PublicKeyCredentialType.PUBLIC_KEY)
+ .transports(Set.of(AuthenticatorTransport.USB))
+ .build();
+ // @formatter:on
+ generatorByClassName.put(AuthenticatorTransport.class, (a) -> AuthenticatorTransport.USB);
+ generatorByClassName.put(PublicKeyCredentialType.class, (k) -> PublicKeyCredentialType.PUBLIC_KEY);
+ generatorByClassName.put(UserVerificationRequirement.class, (r) -> UserVerificationRequirement.REQUIRED);
+ generatorByClassName.put(CredProtect.class, (c) -> credProtect);
+ generatorByClassName.put(CredProtectAuthenticationExtensionsClientInput.class, (c) -> new CredProtectAuthenticationExtensionsClientInput(credProtect));
+ generatorByClassName.put(ImmutableAuthenticationExtensionsClientInputs.class, (i) -> inputs);
+ generatorByClassName.put(ImmutableAuthenticationExtensionsClientInput.class, (i) -> ImmutableAuthenticationExtensionsClientInput.credProps);
+ generatorByClassName.put(Bytes.class, (b) -> id);
+ generatorByClassName.put(PublicKeyCredentialDescriptor.class, (d) -> descriptor);
+ // @formatter:off
+ generatorByClassName.put(PublicKeyCredentialRequestOptions.class, (o) -> PublicKeyCredentialRequestOptions.builder()
+ .allowCredentials(List.of(descriptor))
+ .rpId("example.localhost")
+ .challenge(Bytes.fromBase64("I69THX904Q8ONhCgUgOu2PCQCcEjTDiNmokdbgsAsYU"))
+ .userVerification(UserVerificationRequirement.REQUIRED)
+ .extensions(inputs)
+ .timeout(Duration.ofMinutes(5))
+ .build()
+ );
+ // @formatter:on
+
// core
generatorByClassName.put(RunAsUserToken.class, (r) -> {
RunAsUserToken token = new RunAsUserToken("key", user, "creds", user.getAuthorities(),
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.AuthenticatorTransport.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.AuthenticatorTransport.serialized
index 0d01811165..183124aa4e 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.AuthenticatorTransport.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.AuthenticatorTransport.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.Bytes.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.Bytes.serialized
index 3dc7608b31..ab84f3d466 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.Bytes.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.Bytes.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput$CredProtect.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput$CredProtect.serialized
index a9cb157ed6..0222d302d6 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput$CredProtect.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput$CredProtect.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput.serialized
index d8aa7fbdc2..0b0b44e588 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs.serialized
index 76c3d0721a..d5b3e16ebf 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor.serialized
index 38464c6b7c..0be43e15f6 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions.serialized
index 13ba7cbe42..55be7ff688 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialType.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialType.serialized
index 54b9156e0b..efc9d8e3ee 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialType.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.PublicKeyCredentialType.serialized differ
diff --git a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.UserVerificationRequirement.serialized b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.UserVerificationRequirement.serialized
index b4947d37fa..7fde55c0e1 100644
Binary files a/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.UserVerificationRequirement.serialized and b/config/src/test/resources/serialized/6.5.x/org.springframework.security.web.webauthn.api.UserVerificationRequirement.serialized differ
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorTransport.java b/web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorTransport.java
index 8f725d1d80..0974d29569 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorTransport.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorTransport.java
@@ -16,10 +16,9 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
/**
* AuthenticatorTransport
@@ -31,7 +30,8 @@
*/
public final class AuthenticatorTransport implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = -5617945441117386982L;
/**
* usbc
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/Bytes.java b/web/src/main/java/org/springframework/security/web/webauthn/api/Bytes.java
index 1b871db7ac..7a2c769ad4 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/Bytes.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/Bytes.java
@@ -16,12 +16,12 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Base64;
-import org.springframework.security.core.SpringSecurityCoreVersion;
import org.springframework.util.Assert;
/**
@@ -32,7 +32,8 @@
*/
public final class Bytes implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = -7420539646106189663L;
private static final SecureRandom RANDOM = new SecureRandom();
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java b/web/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java
index e2e8c70bc4..e28da6d789 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java
@@ -16,10 +16,9 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
/**
* Implements
@@ -31,7 +30,8 @@
public class CredProtectAuthenticationExtensionsClientInput
implements AuthenticationExtensionsClientInput {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = -6418175591005843455L;
private final CredProtect input;
@@ -51,7 +51,8 @@ public CredProtect getInput() {
public static class CredProtect implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = 109597301115842688L;
private final ProtectionPolicy credProtectionPolicy;
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInput.java b/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInput.java
index d7da31c081..ad479b4a01 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInput.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInput.java
@@ -16,7 +16,7 @@
package org.springframework.security.web.webauthn.api;
-import org.springframework.security.core.SpringSecurityCoreVersion;
+import java.io.Serial;
/**
* An immutable {@link AuthenticationExtensionsClientInput}.
@@ -28,7 +28,8 @@
*/
public class ImmutableAuthenticationExtensionsClientInput implements AuthenticationExtensionsClientInput {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = -1738152485672656808L;
/**
* https://www.w3.org/TR/webauthn-3/#sctn-authenticator-credential-properties-extension
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInputs.java b/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInputs.java
index dfea2d93ea..f9c43608b1 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInputs.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientInputs.java
@@ -16,11 +16,10 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.util.Arrays;
import java.util.List;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
/**
* An immutable implementation of {@link AuthenticationExtensionsClientInputs}.
*
@@ -29,7 +28,8 @@
*/
public class ImmutableAuthenticationExtensionsClientInputs implements AuthenticationExtensionsClientInputs {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = 4277817521578485720L;
private final List inputs;
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialDescriptor.java b/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialDescriptor.java
index 5f4b331aa3..6fbe5250ac 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialDescriptor.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialDescriptor.java
@@ -16,11 +16,10 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
import java.util.Set;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
/**
* PublicKeyCredentialDescriptor
@@ -34,7 +33,8 @@
*/
public final class PublicKeyCredentialDescriptor implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = 8793385059692676240L;
private final PublicKeyCredentialType type;
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialRequestOptions.java b/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialRequestOptions.java
index 1bdc880d30..9cadc1cb29 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialRequestOptions.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialRequestOptions.java
@@ -16,6 +16,7 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
import java.time.Duration;
import java.util.ArrayList;
@@ -23,7 +24,6 @@
import java.util.List;
import java.util.function.Consumer;
-import org.springframework.security.core.SpringSecurityCoreVersion;
import org.springframework.util.Assert;
/**
@@ -36,7 +36,8 @@
*/
public final class PublicKeyCredentialRequestOptions implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = -2970057592835694354L;
private final Bytes challenge;
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialType.java b/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialType.java
index e00b7f1c75..99087a5d29 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialType.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialType.java
@@ -16,10 +16,9 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
/**
* The PublicKeyCredentialType
@@ -30,7 +29,8 @@
*/
public final class PublicKeyCredentialType implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = 7025333122210061679L;
/**
* The only credential type that currently exists.
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/UserVerificationRequirement.java b/web/src/main/java/org/springframework/security/web/webauthn/api/UserVerificationRequirement.java
index ca33111828..dcbabead87 100644
--- a/web/src/main/java/org/springframework/security/web/webauthn/api/UserVerificationRequirement.java
+++ b/web/src/main/java/org/springframework/security/web/webauthn/api/UserVerificationRequirement.java
@@ -16,10 +16,9 @@
package org.springframework.security.web.webauthn.api;
+import java.io.Serial;
import java.io.Serializable;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
/**
* UserVerificationRequirement
@@ -30,7 +29,8 @@
*/
public final class UserVerificationRequirement implements Serializable {
- private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+ @Serial
+ private static final long serialVersionUID = -2801001231345540040L;
/**
* The