This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new fcc11a099 oct 26 update
fcc11a099 is described below
commit fcc11a0999cab5c985dac770647d3b158f379d21
Author: lprimak <[email protected]>
AuthorDate: Mon Oct 26 18:55:00 2026 -0500
oct 26 update
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
jakarta-ee.html | 60 +++++++++++++++++++++++++++++++++---------------
migration-guide.html | 12 ++++++++++
security-reports.html | 16 +++++++++++++
spring-boot.html | 21 +++++++++++++++++
web.html | 17 ++++++++++++++
7 files changed, 109 insertions(+), 21 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 3cbbf75af..f61e36e7d 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-10-11T06:12:30Z
+Expires: 2027-10-26T23:53:51Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index c379b4436..73d597563 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-10-11T06:12:31Z</updated>
+ <updated>2026-10-26T23:53:51Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/jakarta-ee.html b/jakarta-ee.html
index 3bf5933c4..28f110422 100644
--- a/jakarta-ee.html
+++ b/jakarta-ee.html
@@ -806,12 +806,32 @@ authc.logoutFallbackType = $fallbackType</code></pre>
</div>
</div>
<div class="sect3">
-<h4 id="form_resubmit">Automatic form submit upon subsequent login</h4>
+<h4 id="form_resubmit">Automatic form data saving and replay after session
expiry</h4>
<div class="paragraph">
-<p>Jakarta EE module will automatically resubmit forms when session expires
and a subsequent re-login occurs. This will prevent users data from loss due to
sessions timing out.</p>
+<p>Imagine a user filling out a long form, getting distracted by another
browser tab, and stepping away for lunch.
+When they return, finish the form, and submit it, their session has expired
and they are sent to the login page.
+Without form recovery, they would have to enter their work all over again.</p>
+</div>
+<div class="paragraph">
+<p>Shiro solves this problem. No more "your session has expired" messages and
lost work.</p>
+</div>
+<div class="paragraph">
+<p>If a user submits a form after their session has expired, Shiro saves the
entered data before sending them to the login page.
+After they sign in again, Shiro automatically replays the saved form data, so
they do not have to re-enter their work.
+This works with JSP, Jakarta Faces forms (including Ajax), and PrimeFaces
components.
+File uploads are not saved.</p>
+</div>
+<div class="paragraph">
+<p>For pages that do not require the user to sign in, the form data saving and
submission works even without visiting the login page.
+This applies to remembered users and visitors who are not signed in, even
after their session expires.</p>
+</div>
+<div class="paragraph">
+<p>When an Ajax form continues after session expiry without another login,
Shiro updates the whole page by default so its other forms remain usable too.
+To update only the parts normally updated by that form, set the
<code>org.apache.shiro.form-resubmit.ajax-render-all.disabled</code> context
parameter to <code>true</code>.
+To disable the no-login recovery for visitors who are not signed in while
keeping it for remembered users, set
<code>org.apache.shiro.form-resubmit.anonymous.disabled</code> to
<code>true</code>.</p>
</div>
<div class="listingblock">
-<div class="title">To disable this behavior, add the following to
<code>web.xml</code>:</div>
+<div class="title">To disable automatic form saving and recovery, add the
following to <code>web.xml</code>:</div>
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs"
data-lang="xml"><context-param>
<param-name>org.apache.shiro.form-resubmit.disabled</param-name>
@@ -820,7 +840,23 @@ authc.logoutFallbackType = $fallbackType</code></pre>
</div>
</div>
<div class="paragraph">
-<p>During form resubmissions, the original request is replayed, and the
response is relayed back to the browser, along with any cookies generated.
Cookies are set to be secure by default.</p>
+<p>If a saved submission cannot be completed after login, Shiro returns the
user to the original page.</p>
+</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-note" title="Note"></i>
+</td>
+<td class="content">
+If your application uses custom servlet filters that must also run when Shiro
replays a saved form, map them to <code>FORWARD</code> as well as
<code>REQUEST</code>.
+Leave Shiro’s <code>filterOncePerRequest</code> disabled.
+</td>
+</tr>
+</table>
+</div>
+<div class="paragraph">
+<p>Form-resubmission cookies are secure by default.</p>
</div>
<div class="listingblock">
<div class="title">To disable secure cookie attribute, add the following to
<code>web.xml</code>:</div>
@@ -835,7 +871,7 @@ authc.logoutFallbackType = $fallbackType</code></pre>
<p>Alternatively, you can set
<code>org.apache.shiro.form-resubmit.secure-cookies</code> system property in
the same manner as above.</p>
</div>
<div class="paragraph">
-<p>By default, form resubmission logic replays the request to the original
URI. This works for most cases, but in some deployments, such as certain Docker
or Kubernetes, host, port or both need to be modified during resubmission.
There are two system properties to allow this:
<code>org.apache.shiro.form-resubmit-host</code> (String) and
<code>org.apache.shiro.form-resubmit-port</code> (Integer).</p>
+<p>The <code>org.apache.shiro.form-resubmit-host</code> and
<code>org.apache.shiro.form-resubmit-port</code> system properties used by
older releases are no longer needed or used.</p>
</div>
</div>
<div class="sect3">
@@ -903,20 +939,6 @@ without any additional annotations or configuration.</p>
</div>
</div>
<div class="sect2">
-<h3
id="automatic_form_resubmit_when_logged_out_and_subsequently_logged_in">Automatic
form resubmit when logged out and subsequently logged in</h3>
-<div class="paragraph">
-<p>Users get frustrated when they lose data. For example, while filling out a
complicated form,
-the user get side-tracked with another browser tab or window. Then lunch.
After getting back to the form,
-they will fill out the rest of the form and submit it. However, since it took
a long time, they are now thrown
-back to the login screen. Once they log in, all their data entry vanished!<br>
-There are few workarounds for his issue, like a periodic ping of the back-end
or something similar, but that causes unnecessary load and memory pressure on
the server. These methods are also very brittle.<br>
-Jakarta EE module will automatically save the form data into Shiro cache when
a user is redirected to a login screen.
-The cache is encrypted. And when the user subsequently logs back in, the form
is automatically submitted and
-the data entry is never lost.<br>
-Form resubmission works with JSP, Jakarta Faces partial page rendering (Ajax)
and with PrimeFaces components.</p>
-</div>
-</div>
-<div class="sect2">
<h3 id="using_cdi_sessionscoped_and_viewscoped_beans">Using CDI
<code>@SessionScoped</code> and <code>@ViewScoped</code> beans</h3>
<div class="paragraph">
<p>Both CDI and OmniFaces Session and ViewScoped beans work correctly and
transparently with both web container and Shiro native sessions.</p>
diff --git a/migration-guide.html b/migration-guide.html
index 415fcd91d..4b7f59b26 100644
--- a/migration-guide.html
+++ b/migration-guide.html
@@ -524,6 +524,18 @@
<div class="paragraph">
<p>Applications still on Spring Boot 2.x or 3.x should use Shiro 2.x with the
appropriate classifier configuration.</p>
</div>
+<div class="sect3">
+<h4 id="path_matching_with_spring_boot_4_2">Path Matching with Spring Boot
4.2</h4>
+<div class="paragraph">
+<p>Spring Boot 4.2 removes the Ant matching strategy.
+Shiro keeps Ant matching where supported and switches to Spring-parsed
patterns when Ant parser is no longer available.</p>
+</div>
+<div class="paragraph">
+<p>Review Shiro chain definitions for Spring path-pattern compatibility, as
invalid patterns will fail at startup.
+Shiro’s case-insensitive default, trailing-slash retry, first-match
chain ordering, and deny-by-default fallback are preserved.
+See <a href="spring-boot.html#path-matching">Spring Boot path matching</a> for
details.</p>
+</div>
+</div>
</div>
</div>
</div>
diff --git a/security-reports.html b/security-reports.html
index cd7c1bcb6..f553b41cf 100644
--- a/security-reports.html
+++ b/security-reports.html
@@ -518,6 +518,22 @@ The authentication bypass occurs when Shiro and Spring
Boot are using different
<pre class="highlightjs highlight"><code class="language-properties hljs"
data-lang="properties">spring.mvc.pathmatch.matching-strategy =
ant_path_matcher</code></pre>
</div>
</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-note" title="Note"></i>
+</td>
+<td class="content">
+<div class="paragraph">
+<p>The configuration workaround above applies only to Spring Boot versions
that support Ant matching.
+Boot 4.2 removes that setting’s Ant option.
+For Shiro’s automatic Spring-pattern integration, see <a
href="spring-boot.html#path-matching">Spring Boot path matching</a>.</p>
+</div>
+</td>
+</tr>
+</table>
+</div>
<div class="paragraph">
<p><strong>Credit:</strong>
Apache Shiro would like to thank v3ged0ge and Adamytd for reporting this
issue.</p>
diff --git a/spring-boot.html b/spring-boot.html
index 1cc2296f2..c54c7909f 100644
--- a/spring-boot.html
+++ b/spring-boot.html
@@ -231,6 +231,7 @@
<ul class="sectlevel1">
<li><a href="#web_applications">Web Applications</a>
<ul class="sectlevel2">
+<li><a href="#path-matching">Path Matching</a></li>
<li><a href="#enabling_shiro_annotations">Enabling Shiro Annotations</a></li>
<li><a href="#annotations_and_web_applications">Annotations and Web
Applications</a></li>
<li><a href="#caching">Caching</a></li>
@@ -430,6 +431,26 @@ public ShiroFilterChainDefinition
shiroFilterChainDefinition() {
<p>You can see a full example in our <a
href="https://github.com/apache/shiro/tree/main/samples/spring-boot-web";>samples
on GitHub</a>.</p>
</div>
<div class="sect2">
+<h3 id="path-matching">Path Matching</h3>
+<div class="paragraph">
+<p>The starter requests Ant path matching from Spring MVC while Boot supports
that setting.
+Spring Boot 4.2 removes the Ant matching strategy.
+When MVC uses Spring-native <code>PathPatternParser</code> instead, the
starter uses Spring parsed patterns for both Shiro filter-chain selection and
path-aware filters.</p>
+</div>
+<div class="paragraph">
+<p>In Spring-pattern mode, chain definitions must use <a
href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/util/pattern/PathPattern.html";>Spring
path-pattern syntax</a>.
+Invalid configured patterns fail at startup.
+Review existing Ant patterns when upgrading, as the two pattern languages are
not necessarily interchangeable.</p>
+</div>
+<div class="paragraph">
+<p>Shiro retains its case-insensitive default
(<code>shiro.caseInsensitive=true</code>), independently of MVC’s case
sensitivity.
+This helps protect static resources on case-insensitive filesystems.
+Set <code>shiro.caseInsensitive=false</code> only if case-sensitive
authorization matching is intended.
+Shiro also retains its trailing-slash retry, so a restriction on
<code>/admin</code> applies to <code>/admin/</code> and vice versa, even if MVC
distinguishes those paths.
+Filter chains still use first-match ordering and deny access by default when
no configured chain matches.</p>
+</div>
+</div>
+<div class="sect2">
<h3 id="enabling_shiro_annotations">Enabling Shiro Annotations</h3>
<div class="paragraph">
<p>In both standalone and web applications, you might want to use
Shiro’s Annotations for security checks (for example,
<code>@RequiresRoles</code>, <code>@RequiresPermissions</code>, etc.) These
annotations are enabled automatically in both starters listed above.</p>
diff --git a/web.html b/web.html
index 476d88141..819f78366 100644
--- a/web.html
+++ b/web.html
@@ -679,6 +679,23 @@ For example, <code>/WEB-INF/some/path/shiro.ini</code></p>
<div class="paragraph">
<p>The token on the left of the equals sign (=) is an <a
href="https://ant.apache.org";>Ant</a>-style path expression relative to your
web application’s context root.</p>
</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-note" title="Note"></i>
+</td>
+<td class="content">
+<div class="paragraph">
+<p>For Spring Boot 4.2 or later applications, Shiro uses Spring-native parsed
patterns instead of Ant.
+This applies to both filter-chain selection and path-aware filters.
+Shiro retains its case-insensitive default and trailing-slash retry.
+See <a href="spring-boot.html#path-matching">Spring Boot path matching</a>
before migrating Ant chain definitions.</p>
+</div>
+</td>
+</tr>
+</table>
+</div>
<div class="paragraph">
<p>For example, let’s say you had the following <code>[urls]</code>
line:</p>
</div>
