This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 752938a25f6af66b30ad80741a495101c01b31d3 Author: lprimak <[email protected]> AuthorDate: Wed Aug 19 19:54:02 2026 -0500 bugfix: set rememberMe deletion cookie up correctly --- web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java | 5 ++--- .../java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java | 2 ++ 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java index d7d2644a3..961c728dc 100644 --- a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java +++ b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java @@ -423,7 +423,6 @@ public class SimpleCookie implements Cookie { @Override public void removeFrom(HttpServletRequest request, HttpServletResponse response) { String name = getName(); - String value = DELETED_COOKIE_VALUE; //don't need to add extra size to the response - comments are irrelevant for deletions String comment = null; String domain = getDomain(); @@ -431,12 +430,12 @@ public class SimpleCookie implements Cookie { //always zero for deletion int maxAge = 0; int version = getVersion(); - boolean secure = isSecure(); + boolean secure = isSecure() && request.isSecure(); //no need to add the extra text, plus the value 'deleteMe' is not sensitive at all boolean httpOnly = false; SameSiteOptions sameSite = getSameSite(); - addCookieHeader(response, name, value, null, domain, path, maxAge, version, secure, httpOnly, sameSite); + addCookieHeader(response, name, DELETED_COOKIE_VALUE, null, domain, path, maxAge, version, secure, httpOnly, sameSite); LOGGER.trace("Removed '{}' cookie by setting maxAge=0", name); } diff --git a/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java b/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java index 60043aecf..73288ba08 100644 --- a/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java +++ b/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java @@ -241,6 +241,7 @@ class CookieRememberMeManagerTest { }; expect(mockRequest.getCookies()).andReturn(cookies); + expect(mockRequest.isSecure()).andReturn(false); replay(mockRequest); CookieRememberMeManager mgr = new CookieRememberMeManager(); @@ -350,6 +351,7 @@ class CookieRememberMeManagerTest { expect(mockRequest.getAttribute(ShiroHttpServletRequest.IDENTITY_REMOVED_KEY)).andReturn(null); expect(mockRequest.getContextPath()).andReturn(null); expect(mockRequest.getCookies()).andReturn(cookies); + expect(mockRequest.isSecure()).andReturn(false); replay(mockRequest); // when
