Webauthn improvements : docs, customisable cookies, virtual thread support

[FroMage]

This is mostly docs improvements, but also #38352 and #38351

[FroMage]

For @cescoffier 's review, it's mostly about the logic in https://github.com/quarkusio/quarkus/pull/38373/files#diff-493a6f5a982ad741f9a8c8b0a8485833005410f7e2fb3062f4c53290a7238dfeR44 that I'm not entirely convinced about.

There are tests, though, but a logic/sanity check would not hurt.

[cescoffier]

The virtual thread part looks good to me!

[FroMage]

First failure is my fault, but the second one about import sorting is annoying, locally it's not run:

[INFO] --- impsort-maven-plugin:1.9.0:sort (sort-imports) @ quarkus-integration-test-virtual-threads-security-webauthn ---
[INFO] Skipping execution of impsort-maven-plugin

[FroMage]

Oh great, so I have to run the build on java < 20, then java 20.

[github-actions]

🙈 The PR is closed and the preview is expired.

[FroMage]

Yeah, the quickstarts have their own PR at quarkusio/quarkus-quickstarts#1377 how do we get out of this kind of chicken/egg issue @gsmet ?

[sberyozkin]

Hi Steph, @FroMage, thanks for the PR. This is for main , so I've been thinking, I'll need to work through the tutorial and catch up a bit on some WebAuthn mechanics, spec details, as it is getting a bit vague for me, and then I'll be happy to review. Hope you are OK with it, we have a lot of time before 3.9 is released, I'll try to finish it within up to 2 weeks.
Clement's review is enough to merge, so if you'd like, go ahead, only keep it open if you'd like to wait for one more approval.

Cheers

[FroMage]

This PR doesn't change any mechanics of webauthn beyond giving the ability to configure the cookie names in use, and allowing virtual threads where blocking calls were also allowed.

As such, it can be reviewed without any webauthn knowledge.

[sberyozkin]

@FroMage Apologies for a delay, while I definitely want to start helping with more concrete reviews, I'm falling behind right now and don't want to hold this important PR with various fixes, it should be part of 3.9 for sure. @cescoffier has already approved, so please go ahead with the merge when you are ready, thanks

[FroMage]

Yeah, the quickstarts have their own PR at quarkusio/quarkus-quickstarts#1377 how do we get out of this kind of chicken/egg issue @gsmet ?

@gsmet what's the procedure for merging inter-dependent PRs?

[FroMage]

Not sure what that failure was about, rebased and retrying.

[FroMage]

I don't understand why the enforcer plugin runs locally:

[INFO] --- enforcer:3.2.1:enforce (enforce) @ quarkus-integration-test-virtual-threads-security-webauthn ---
Downloading from apache.snapshots: https://repository.apache.org/snapshots/io/quarkus/quarkus-parent/999-SNAPSHOT/maven-metadata.xml
[INFO] Rule Config Provider org.apache.maven.enforcer.rules.ExternalRules executed
[INFO] Rule Config Provider org.apache.maven.enforcer.rules.ExternalRules executed
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO] Rule 1: io.quarkus.enforcer.RequiresMinimalDeploymentDependency passed
[INFO] Rule 2: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed
[INFO] Rule 3: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 82efe40.

Failing Jobs

Status	Name	Step	Failures	Logs	Raw logs	Build scan
✖	Quickstarts Compilation - JDK 17	Compile Quickstarts	Failures	Logs	Raw logs	🚧

You can consult the Develocity build scans.

Failures

⚙️ Quickstarts Compilation - JDK 17 #

- Failing: security-webauthn-quickstart security-webauthn-reactive-quickstart 

📦 security-webauthn-quickstart

✖ Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.11.0:testCompile (default-testCompile) on project security-webauthn-quickstart: Compilation failure

📦 security-webauthn-reactive-quickstart

✖ Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.11.0:testCompile (default-testCompile) on project security-webauthn-reactive-quickstart: Compilation failure

[quarkus-bot]

Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 82efe40.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[FroMage]

Quickstart failure is normal, as there's a separate PR for it.

[FroMage]

No answer about quickstart, let's just merge this and get this done.