@Bean
            @ConditionalOnMissingBean(name = "webAuthnProtocolEndpointConfigurer")
            @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
            public CasWebSecurityConfigurer<HttpSecurity> webAuthnProtocolEndpointConfigurer(
                @Qualifier("webAuthnCsrfTokenRepository")
                final ObjectProvider<CsrfTokenRepository> webAuthnCsrfTokenRepository) {
                return new CasWebSecurityConfigurer<>() {
                    @Override
                    @CanIgnoreReturnValue
                    @SuppressWarnings("UnnecessaryMethodReference")
                    public CasWebSecurityConfigurer<HttpSecurity> configure(final HttpSecurity http) throws Exception {
                        http.csrf(customizer -> webAuthnCsrfTokenRepository.ifAvailable(repository -> {
                            val pattern = PathPatternRequestMatcher.withDefaults().matcher(BaseWebAuthnController.BASE_ENDPOINT_WEBAUTHN + "/**");
                            val delegate = new XorCsrfTokenRequestAttributeHandler();
                            delegate.setSecureRandom(RandomUtils.getNativeInstance());
                            customizer
                                .ignoringRequestMatchers(matcher -> HttpMethod.GET.matches(matcher.getMethod()))
                                .requireCsrfProtectionMatcher(pattern)
                                .csrfTokenRequestHandler(delegate::handle)
                                .csrfTokenRepository(repository);

                        }));
                        http.authorizeHttpRequests(customizer -> {
                            val regEndpoints = PathPatternRequestMatcher.withDefaults()
                                .matcher(BaseWebAuthnController.BASE_ENDPOINT_WEBAUTHN + WebAuthnController.WEBAUTHN_ENDPOINT_REGISTER + "/**");
                            val authEndpoints = PathPatternRequestMatcher.withDefaults()
                                .matcher(BaseWebAuthnController.BASE_ENDPOINT_WEBAUTHN + WebAuthnController.WEBAUTHN_ENDPOINT_AUTHENTICATE + "/**");
                            val qrAuthEndpoints = PathPatternRequestMatcher.withDefaults()
                                .matcher(BaseWebAuthnController.BASE_ENDPOINT_WEBAUTHN + WebAuthnQRCodeController.ENDPOINT_QR_VERIFY + "/**");
                            customizer.requestMatchers(regEndpoints)
                                .access(new WebExpressionAuthorizationManager("hasRole('USER') and isAuthenticated()"));
                            customizer.requestMatchers(authEndpoints, qrAuthEndpoints).permitAll();
                        });
                        return this;
                    }
                };
            }
This is {@link WebAuthnConfiguration}.

@author Misagh Moayyed
@since 6.1.0
support/cas-server-support-webauthn/src/main/java/org/apereo/cas/config/WebAuthnConfiguration.java