(shiro) branch main updated: Deprecate RandomSessionIdGenerator due to insufficient entropy (#2770)

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git


The following commit(s) were added to refs/heads/main by this push:
     new 744128df6 Deprecate RandomSessionIdGenerator due to insufficient 
entropy (#2770)
744128df6 is described below

commit 744128df61c5f6342b891d4ef53f79858f1d6398
Author: Lenny Primak <le...@flowlogix.com>
AuthorDate: Fri Jun 12 20:43:18 2026 -0400

    Deprecate RandomSessionIdGenerator due to insufficient entropy (#2770)
---
 .../org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java     | 3 +++
 1 file changed, 3 insertions(+)

diff --git 
a/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java
 
b/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java
index d4249cd70..0689b8ab2 100644
--- 
a/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java
+++ 
b/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java
@@ -30,7 +30,10 @@ import java.util.Random;
  * implementation is a {@link java.security.SecureRandom SecureRandom} with 
the {@code SHA1PRNG} algorithm.
  *
  * @since 1.0
+ * @deprecated since 2.2.1. Use {@link JavaUuidSessionIdGenerator} instead, as 
this class is no longer considered
+ * secure by modern standards.
  */
+@Deprecated(forRemoval = true, since = "2.2.1")
 public class RandomSessionIdGenerator implements SessionIdGenerator {
 
     private static final Logger LOGGER = 
LoggerFactory.getLogger(RandomSessionIdGenerator.class);