The process of certification

[asfdnkw]

In your samples program, I can't find how login authentication is performed. I haven't found any login interface. It seems to be done by simply sending a login request. How does webauthn authenticate? Is it through filterChain method http.apply(WebAuthnLoginConfigurer.webAuthnLogin())

Does it automatically intercept webauthn authentication? I don't know how to write the login URL to pass webauthn authentication. I logged in through Windows Hello

[asfdnkw]

How should I remove these credentials from my Windows system computer. I don't know if it's because there are too many registered accounts. Sometimes, after registering, when I click to log in, I can't find them in my picture. I want to delete them all. How to operate it

[ynojima]

Please create a discussion per topic. If you wish to discuss a different topic, please create a separate discussion.

The management of WebAuthn credentials stored on a device is the responsibility of that device. In this case, it is Windows.
Unfortunately, Windows does not provide a user interface for managing WebAuthn credentials, and there appears to be no method to delete them individually.

It seems that initializing Windows Hello by removing and resetting your Windows Hello PIN allows you to delete WebAuthn credentials.
But be careful—this will erase all your WebAuthn credentials.

[ynojima]

The WebAuthnProcessingFilter is registered by http.apply(WebAuthnLoginConfigurer.webAuthnLogin()), and it intercepts authentication requests.
The login endpoint can be configured with loginProcessingUrl.
Reference: https://github.com/webauthn4j/webauthn4j-spring-security-samples/blob/main/spa/src/main/java/com/webauthn4j/springframework/security/webauthn/sample/app/config/WebSecurityConfig.java#L113

[asfdnkw]

This problem has been solved. There is a problem with the way I send requests on the front-end.

[asfdnkw]

But it failed during verification. The final result returned is still 401 Unauthorized
I got through the interruption point that there was a successful authentication exception. But it was not reported in the console. I don't know why this successful authentication occurred

[asfdnkw]

The breakpoint result of the attemptAuthentication method of WebAuthnProcessingFilter is as follows.



I don't know where the problem lies.

[asfdnkw]

[ynojima]

So, the process has reached the point where WebAuthnProcessingFilter generates an instance of WebAuthnAssertionAuthenticationToken.
After that, it seems that the ProviderManager throws a BadCredentialException.
Do you have the stack trace for when the BadCredentialException occurs?