WebAuthn registration fails with 403 Forbidden on Firefox (CSRF token mismatch)

[Frédéric MAZZINI]

Environment: CAS 8.0.2, Firefox (Linux/Windows/macOS), WebAuthn MFA enabled.

Problem Description: During login authentication, the response headers contain duplicate Set-Cookie: XSRF-TOKEN headers (due to Spring Security's CsrfAuthenticationStrategy session/token rotation):

http
Set-Cookie: XSRF-TOKEN=tokenA; Path=/; Secure

Set-Cookie: XSRF-TOKEN=tokenB; Path=/; Secure

While Chromium browsers may handle this differently, Firefox strictly respects RFC precedence and stores the second cookie (tokenB). However, the Thymeleaf template rendered for the WebAuthn registration view binds to tokenA.

When webauthn.js performs the POST request to /webauthn/register:

• Browser sends Cookie: XSRF-TOKEN=tokenB
• webauthn.js sends X-CSRF-TOKEN: tokenA (from DOM)

Spring Security detects the mismatch and returns a 403 Forbidden.

Proposed Fix: Update webauthn.js to dynamically read the active XSRF-TOKEN cookie from document.cookie before sending the request, ensuring the header matches the stored cookie.