authentication object is null for second-factor and third-factor post methods in MfaController in mfa module

Open
#344 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
java, spring, spring-boot
Domain
authentication, backend

Research direction

Start with mfa/src/main/java/example/MfaController.java and reproduce the second-factor and third-factor POST requests in the MFA sample. Compare the method parameters with SecurityContextHolder usage and trace how authentication arguments are resolved. Done means explaining the null parameter and documenting or correcting the sample behavior, with the relevant MFA flow verified.

Written by the indexing model from the issue text.

Description

I fail to pass through the second factor and third factor authentication in the mfa module because in the both case the MfaAuthentication authentication is null

Below is more detail explanation:

in /mfa/src/main/java/example/MfaController.java file

	@PostMapping("/second-factor")
	public void processSecondFactor(@RequestParam("code") String code, MfaAuthentication authentication,
			HttpServletRequest request, HttpServletResponse response) throws Exception {
                
                // authentication object is null but if I write it like below, I get the authentication object
		// MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication();

		MfaAuthenticationHandler handler = new MfaAuthenticationHandler("/third-factor");
		...
	}

	@PostMapping("/third-factor")
	public void processThirdFactor(@RequestParam("answer") String answer, MfaAuthentication authentication,
			HttpServletRequest request, HttpServletResponse response) throws Exception {

                // authentication object is null but if I write it like below, I get the authentication object
		// MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication();

		String encodedAnswer = getAnswer(authentication);
		...
	}

Can anyone explain why this is happening? I tried to debug but fail to get any explanation.

Dominant language
Java
Stars
1.8k
Forks
797
Avg merge
3m
Merged PRs (30d)
5

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from spring-projects/spring-security-samples

All issues in spring-projects/spring-security-samples

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.