Lazily instantiate default components in WebAuthnConfigurer

Open Beginner friendly
#18,585 1 comment 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java

Research direction

Start at the configure method of WebAuthnConfigurer and inspect userEntityRepository() and userCredentialRepository(). Replace the eager Optional defaults with lazy defaults, then verify that the default repositories are created only when the corresponding ApplicationContext beans are absent.

Written by the indexing model from the issue text.

Description

status: waiting-for-triage type: enhancement

Avoid unnecessary instantiation of MapPublicKeyCredentialUserEntityRepository and MapUserCredentialRepository in WebAuthnConfigurer

In the configure method of WebAuthnConfigurer, Optional.orElse() is currently
used to provide default implementations when specific Beans are not found
in the ApplicationContext.

public class WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractHttpConfigurer<WebAuthnConfigurer<H>, H> {
         // ... 
	@Override
	public void configure(H http) {
                 / ...
                 // Uses orElse(): Always instantiates default repositories
		PublicKeyCredentialUserEntityRepository userEntities = getSharedOrBean(http,
				PublicKeyCredentialUserEntityRepository.class)
			.orElse(userEntityRepository());
		UserCredentialRepository userCredentials = getSharedOrBean(http, UserCredentialRepository.class)
			.orElse(userCredentialRepository());
                 / ... 
    } 
} 

However, orElse() evaluates its argument eagerly. As a result,
userEntityRepository() and userCredentialRepository() are always invoked,
instantiating new repository objects even when a corresponding repository
Bean is already present in the ApplicationContext.

This leads to unnecessary object creation each time the configuration
is initialized.

I propose replacing orElse with orElseGet to ensure that the default
repositories are instantiated only when the Optional is empty.

	public void configure(H http) {

                 // Uses orElseGet(): Instantiates only when necessary
		PublicKeyCredentialUserEntityRepository userEntities = getSharedOrBean(http,
				PublicKeyCredentialUserEntityRepository.class)
			.orElseGet(this::userEntityRepository);
		UserCredentialRepository userCredentials = getSharedOrBean(http, UserCredentialRepository.class)
			.orElseGet(this::userCredentialRepository);
    } 

This change aligns with Java Optional best practices by avoiding unnecessary
object creation and ensuring that default components are initialized only
when they are actually needed.

Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from spring-projects/spring-security

All issues in spring-projects/spring-security

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.