Make WebAuthnAuthenticationRequestToken Serializable

Closes gh-16481

Signed-off-by: Max Batischev <mblancer@mail.ru>

web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticationExtensionsClientOutput.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serializable;
+
 /**
  * A <a href="https://www.w3.org/TR/webauthn-3/#client-extension-output">client extension
  * output</a> entry in {@link AuthenticationExtensionsClientOutputs}.
@@ -24,7 +26,7 @@ package org.springframework.security.web.webauthn.api;
  * @see AuthenticationExtensionsClientOutputs#getOutputs()
  * @see CredentialPropertiesOutput
  */
-public interface AuthenticationExtensionsClientOutput<T> {
+public interface AuthenticationExtensionsClientOutput<T> extends Serializable {
 
 	/**
 	 * Gets the <a href="https://www.w3.org/TR/webauthn-3/#extension-identifier">extension

web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticationExtensionsClientOutputs.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serializable;
 import java.util.List;
 
 /**
@@ -31,7 +32,7 @@ import java.util.List;
  * @since 6.4
  * @see PublicKeyCredential#getClientExtensionResults()
  */
-public interface AuthenticationExtensionsClientOutputs {
+public interface AuthenticationExtensionsClientOutputs extends Serializable {
 
 	/**
 	 * Gets all of the {@link AuthenticationExtensionsClientOutput}.

web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorAssertionResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serial;
+
 /**
  * The <a href=
  * "https://www.w3.org/TR/webauthn-3/#authenticatorassertionresponse">AuthenticatorAssertionResponse</a>
@@ -38,6 +40,9 @@ package org.springframework.security.web.webauthn.api;
  */
 public final class AuthenticatorAssertionResponse extends AuthenticatorResponse {
 
+	@Serial
+	private static final long serialVersionUID = 324976481675434298L;
+
 	private final Bytes authenticatorData;
 
 	private final Bytes signature;

web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorResponse.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serializable;
+
 /**
  * The <a href=
  * "https://www.w3.org/TR/webauthn-3/#iface-authenticatorresponse">AuthenticatorResponse</a>
@@ -26,7 +28,7 @@ package org.springframework.security.web.webauthn.api;
  * @author Rob Winch
  * @since 6.4
  */
-public abstract class AuthenticatorResponse {
+public abstract class AuthenticatorResponse implements Serializable {
 
 	private final Bytes clientDataJSON;
 

web/src/main/java/org/springframework/security/web/webauthn/api/CredentialPropertiesOutput.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serial;
+import java.io.Serializable;
+
 /**
  * <a href=
  * "https://www.w3.org/TR/webauthn-3/#dictdef-credentialpropertiesoutput">CredentialPropertiesOutput</a>
@@ -27,6 +30,9 @@ package org.springframework.security.web.webauthn.api;
 public class CredentialPropertiesOutput
 		implements AuthenticationExtensionsClientOutput<CredentialPropertiesOutput.ExtensionOutput> {
 
+	@Serial
+	private static final long serialVersionUID = -3201699313968303331L;
+
 	/**
 	 * The extension id.
 	 */
@@ -59,7 +65,10 @@ public class CredentialPropertiesOutput
 	 * @since 6.4
 	 * @see #getOutput()
 	 */
-	public static final class ExtensionOutput {
+	public static final class ExtensionOutput implements Serializable {
+
+		@Serial
+		private static final long serialVersionUID = 4557406414847424019L;
 
 		private final boolean rk;
 

web/src/main/java/org/springframework/security/web/webauthn/api/ImmutableAuthenticationExtensionsClientOutputs.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serial;
 import java.util.Arrays;
 import java.util.List;
 
@@ -26,6 +27,9 @@ import java.util.List;
  */
 public class ImmutableAuthenticationExtensionsClientOutputs implements AuthenticationExtensionsClientOutputs {
 
+	@Serial
+	private static final long serialVersionUID = -4656390173585180393L;
+
 	private final List<AuthenticationExtensionsClientOutput<?>> outputs;
 
 	public ImmutableAuthenticationExtensionsClientOutputs(List<AuthenticationExtensionsClientOutput<?>> outputs) {

web/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredential.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
 
 package org.springframework.security.web.webauthn.api;
 
+import java.io.Serial;
+import java.io.Serializable;
+
 /**
  * <a href="https://www.w3.org/TR/webauthn-3/#iface-pkcredential">PublicKeyCredential</a>
  * contains the attributes that are returned to the caller when a new credential is
@@ -24,7 +27,10 @@ package org.springframework.security.web.webauthn.api;
  * @author Rob Winch
  * @since 6.4
  */
-public final class PublicKeyCredential<R extends AuthenticatorResponse> {
+public final class PublicKeyCredential<R extends AuthenticatorResponse> implements Serializable {
+
+	@Serial
+	private static final long serialVersionUID = -1864035469276082606L;
 
 	private final String id;
 
@@ -34,7 +40,7 @@ public final class PublicKeyCredential<R extends AuthenticatorResponse> {
 
 	private final R response;
 
-	private final AuthenticatorAttachment authenticatorAttachment;
+	private final transient AuthenticatorAttachment authenticatorAttachment;
 
 	private final AuthenticationExtensionsClientOutputs clientExtensionResults;
 

web/src/main/java/org/springframework/security/web/webauthn/authentication/WebAuthnAuthenticationRequestToken.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package org.springframework.security.web.webauthn.authentication;
 
+import java.io.Serial;
+
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.web.webauthn.management.RelyingPartyAuthenticationRequest;
@@ -30,6 +32,9 @@ import org.springframework.util.Assert;
  */
 public class WebAuthnAuthenticationRequestToken extends AbstractAuthenticationToken {
 
+	@Serial
+	private static final long serialVersionUID = -1682693433877522403L;
+
 	private final RelyingPartyAuthenticationRequest webAuthnRequest;
 
 	/**

web/src/main/java/org/springframework/security/web/webauthn/management/RelyingPartyAuthenticationRequest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
 
 package org.springframework.security.web.webauthn.management;
 
+import java.io.Serial;
+import java.io.Serializable;
+
 import org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse;
 import org.springframework.security.web.webauthn.api.PublicKeyCredential;
 import org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions;
@@ -29,7 +32,10 @@ import org.springframework.util.Assert;
  * @since 6.4
  * @see WebAuthnRelyingPartyOperations#authenticate(RelyingPartyAuthenticationRequest)
  */
-public class RelyingPartyAuthenticationRequest {
+public class RelyingPartyAuthenticationRequest implements Serializable {
+
+	@Serial
+	private static final long serialVersionUID = -928083091875202086L;
 
 	private final PublicKeyCredentialRequestOptions requestOptions;