This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new 29458c742 enh: update documentation for Spring Boot 4.2 path matching
changes
29458c742 is described below
commit 29458c74286ad0a975fc401397412ce023880cec
Author: lprimak <[email protected]>
AuthorDate: Sun Oct 25 19:12:08 2026 -0500
enh: update documentation for Spring Boot 4.2 path matching changes
---
src/site/content/migration-guide.adoc | 9 +++++++++
src/site/content/security-reports.adoc | 7 +++++++
src/site/content/spring-boot.adoc | 17 +++++++++++++++++
src/site/content/web.adoc | 8 ++++++++
4 files changed, 41 insertions(+)
diff --git a/src/site/content/migration-guide.adoc
b/src/site/content/migration-guide.adoc
index f2dee0dd6..d0349000d 100644
--- a/src/site/content/migration-guide.adoc
+++ b/src/site/content/migration-guide.adoc
@@ -196,6 +196,15 @@ Shiro 3.x is designed to work with Spring Boot 4 and later
versions. Spring Boot
Applications still on Spring Boot 2.x or 3.x should use Shiro 2.x with the
appropriate classifier configuration.
+==== Path Matching with Spring Boot 4.2
+
+Spring Boot 4.2 removes the Ant matching strategy.
+Shiro keeps Ant matching where supported and switches to Spring-parsed
patterns when Ant parser is no longer available.
+
+Review Shiro chain definitions for Spring path-pattern compatibility, as
invalid patterns will fail at startup.
+Shiro's case-insensitive default, trailing-slash retry, first-match chain
ordering, and deny-by-default fallback are preserved.
+See link:spring-boot.html#path-matching[Spring Boot path matching] for details.
+
[#security-behavior-changes]
== Security Behavior Changes in 3.x
diff --git a/src/site/content/security-reports.adoc
b/src/site/content/security-reports.adoc
index 6cf502f93..5a53488a7 100644
--- a/src/site/content/security-reports.adoc
+++ b/src/site/content/security-reports.adoc
@@ -177,6 +177,13 @@ The authentication bypass occurs when Shiro and Spring
Boot are using different
spring.mvc.pathmatch.matching-strategy = ant_path_matcher
----
+[NOTE]
+====
+The configuration workaround above applies only to Spring Boot versions that
support Ant matching.
+Boot 4.2 removes that setting's Ant option.
+For Shiro's automatic Spring-pattern integration, see
link:spring-boot.html#path-matching[Spring Boot path matching].
+====
+
**Credit:**
Apache Shiro would like to thank v3ged0ge and Adamytd for reporting this issue.
diff --git a/src/site/content/spring-boot.adoc
b/src/site/content/spring-boot.adoc
index b94347890..162cf7fc4 100644
--- a/src/site/content/spring-boot.adoc
+++ b/src/site/content/spring-boot.adoc
@@ -53,6 +53,23 @@ If you are using Shiro's annotations see the
link:#annotations_and_web_applicati
You can see a full example in our
link:https://github.com/apache/shiro/tree/main/samples/spring-boot-web[samples
on GitHub].
+[#path-matching]
+=== Path Matching
+
+The starter requests Ant path matching from Spring MVC while Boot supports
that setting.
+Spring Boot 4.2 removes the Ant matching strategy.
+When MVC uses Spring-native `PathPatternParser` instead, the starter uses
Spring parsed patterns for both Shiro filter-chain selection and path-aware
filters.
+
+In Spring-pattern mode, chain definitions must use
https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/util/pattern/PathPattern.html[Spring
path-pattern syntax].
+Invalid configured patterns fail at startup.
+Review existing Ant patterns when upgrading, as the two pattern languages are
not necessarily interchangeable.
+
+Shiro retains its case-insensitive default (`shiro.caseInsensitive=true`),
independently of MVC's case sensitivity.
+This helps protect static resources on case-insensitive filesystems.
+Set `shiro.caseInsensitive=false` only if case-sensitive authorization
matching is intended.
+Shiro also retains its trailing-slash retry, so a restriction on `/admin`
applies to `/admin/` and vice versa, even if MVC distinguishes those paths.
+Filter chains still use first-match ordering and deny access by default when
no configured chain matches.
+
=== Enabling Shiro Annotations
In both standalone and web applications, you might want to use Shiro's
Annotations for security checks (for example, `@RequiresRoles`,
`@RequiresPermissions`, etc.) These annotations are enabled automatically in
both starters listed above.
diff --git a/src/site/content/web.adoc b/src/site/content/web.adoc
index f012842aa..5fc5ba5a0 100644
--- a/src/site/content/web.adoc
+++ b/src/site/content/web.adoc
@@ -264,6 +264,14 @@ Next we'll cover exactly what these lines mean.
The token on the left of the equals sign (=) is an
https://ant.apache.org[Ant]-style path expression relative to your web
application's context root.
+[NOTE]
+====
+For Spring Boot 4.2 or later applications, Shiro uses Spring-native parsed
patterns instead of Ant.
+This applies to both filter-chain selection and path-aware filters.
+Shiro retains its case-insensitive default and trailing-slash retry.
+See link:spring-boot.html#path-matching[Spring Boot path matching] before
migrating Ant chain definitions.
+====
+
For example, let's say you had the following `[urls]` line:
[source,ini]
