@Test
    void verifyRegistrationEndpoint() throws Throwable {
        val endpoint = WebAuthnController.WEBAUTHN_ENDPOINT_REGISTER;

        /* Without CSRF token, we must fail */
        executeRequest(endpoint, new MockHttpServletRequest(), new MockHttpServletResponse(), true, HttpStatus.SC_FORBIDDEN);

        /* With CSRF token but without authentication context we continue to fail  */
        val csrfResult = fetchAndStoreCsrfToken();
        executeRequest(endpoint, csrfResult.getRequest(), csrfResult.getResponse(), true, HttpStatus.SC_FORBIDDEN);

        /* Authenticated requests must fail because they do not have the right role */
        val result = executeRequest(endpoint, csrfResult.getRequest(), csrfResult.getResponse(), true, HttpStatus.SC_FORBIDDEN);

        /* Authorization should now pass and reach the endpoint */
        populateSecurityContext(result);
        /* Authenticated requests with the right role should pass */
        executeRequest(endpoint, csrfResult.getRequest(), csrfResult.getResponse(), false, HttpStatus.SC_BAD_REQUEST);

        /* Ensure security context does not interfere with actuator endpoint security */
        mvc.perform(get("/cas/actuator/env"))
            .andExpect(status().isUnauthorized());
        mvc.perform(get("/cas/actuator/env")
                .with(httpBasic("hello", "world")))
            .andExpect(status().isUnauthorized());
        mvc.perform(get("/cas/actuator/env")
                .with(httpBasic(securityProperties.getUser().getName(), securityProperties.getUser().getPassword())))
            .andExpect(status().isOk());
    }
This is {@link WebAuthnControllerMvcTests}.

@author Misagh Moayyed
@since 7.0.0
support/cas-server-support-webauthn/src/test/java/org/apereo/cas/webauthn/web/WebAuthnControllerMvcTests.java