fix(jans-fido2): fix deadlock, sensitive logging, and cookie dedup bugs in FIDO2 script

[imran-ishaq]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #14857

Implementation Details

Fixes 6 pre-existing bugs in Fido2ExternalAuthenticator.py flagged by CodeRabbit during review of #14852 (a docs-only rename PR), not fixed there to keep that PR's scope to docs/naming only:

**1. Deadlock (critical):** getMetaDataConfiguration() could return early while still holding metaDataLoaderLock, before the try/finally that releases it. Moved lock acquisition to immediately wrap the entire method body, including the cached-value check, so the lock is always released.
**2. Robustness**: three call sites read self.metaDataConfiguration directly instead of through the lazy-loading accessor; switched to self.getMetaDataConfiguration() — no behavior change on the normal path, avoids passing None if ever called before the cache is warm.
**3. Sensitive data in logs:** removed print statements that logged tokenResponse, assertion/attestation result entities, decoded allowList cookie contents, and the raw new-credential object. Kept only HTTP status logging.
**4. Cookie dedup no-op:** add_credential_if_not_exists detected a duplicate credential ID but fell through and appended it anyway; now returns immediately on a match.
**5. Cookie parse failure:** getCookieValue could return the raw undecoded string (instead of []) if base64-decoding succeeded but JSON parsing failed, which would throw downstream when iterated. Now resets to [] on any parse failure.
**6. Missing cookie Path/SameSite:** persistCookie now sets an explicit Path=/ and SameSite=Lax, built as a raw Set-Cookie header (matching the existing convention in jans-config-api's OAuth2Resource.java) rather than Cookie.setAttribute, since that method isn't reliably available across Jakarta Servlet API versions.

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mo-auto]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.