authentication object is null for second-factor and third-factor post methods in MfaController in mfa module

[imtiazShakil]

I fail to pass through the second factor and third factor authentication in the mfa module because in the both case the MfaAuthentication authentication is null

Below is more detail explanation:

in /mfa/src/main/java/example/MfaController.java file

	@PostMapping("/second-factor")
	public void processSecondFactor(@RequestParam("code") String code, MfaAuthentication authentication,
			HttpServletRequest request, HttpServletResponse response) throws Exception {
                
                // authentication object is null but if I write it like below, I get the authentication object
		// MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication();

		MfaAuthenticationHandler handler = new MfaAuthenticationHandler("/third-factor");
		...
	}

	@PostMapping("/third-factor")
	public void processThirdFactor(@RequestParam("answer") String answer, MfaAuthentication authentication,
			HttpServletRequest request, HttpServletResponse response) throws Exception {

                // authentication object is null but if I write it like below, I get the authentication object
		// MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication();

		String encodedAnswer = getAnswer(authentication);
		...
	}

Can anyone explain why this is happening? I tried to debug but fail to get any explanation.

[naveen281298kumar]

Spring, by default, does not inject the authentication object when you define it as a parameter. You need to either use the @AuthenticationPrincipal annotation, or you can manually retrieve it using:

MfaAuthentication authentication = (MfaAuthentication) SecurityContextHolder.getContext().getAuthentication().getPrincipal();

[MPTres]

@imtiazShakil i just tried the sample and the same happens here.

manually getting the authentication from the context holder seems to work fine.
But i am not sure if it should actually be injected.. It would be nice if someone from the team could have a look at it and see if that should be there or not.