*Environment:* CAS 8.0.2, Firefox (Linux/Windows/macOS), WebAuthn MFA enabled.
*Problem Description*: During login authentication, the response headers contain duplicate Set-Cookie: XSRF-TOKEN headers (due to Spring Security's CsrfAuthenticationStrategy session/token rotation): *http* Set-Cookie: XSRF-TOKEN=tokenA; Path=/; Secure Set-Cookie: XSRF-TOKEN=tokenB; Path=/; Secure While Chromium browsers may handle this differently, Firefox strictly respects RFC precedence and stores the second cookie (tokenB). However, the Thymeleaf template rendered for the WebAuthn registration view binds to tokenA. When webauthn.js performs the POST request to /webauthn/register: - Browser sends Cookie: XSRF-TOKEN=tokenB - webauthn.js sends X-CSRF-TOKEN: tokenA (from DOM) Spring Security detects the mismatch and returns a 403 Forbidden. Proposed Fix: Update webauthn.js to dynamically read the active XSRF-TOKEN cookie from document.cookie before sending the request, ensuring the header matches the stored cookie. -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/4ba49fa7-6584-45cc-ae0b-eeab284f010dn%40apereo.org.
