This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new b9848b31a oct 26.1 update
b9848b31a is described below
commit b9848b31a69ec6bf2f9809198d3cb8dc6443ee6e
Author: lprimak <[email protected]>
AuthorDate: Mon Oct 26 19:05:58 2026 -0500
oct 26.1 update
---
.well-known/security.txt | 2 +-
blog/2024/02/apache-shiro-200-released.html | 2 +-
feed.xml | 2 +-
jakarta-ee.html | 37 +++++++++++++++++++++++++++--
4 files changed, 38 insertions(+), 5 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index f61e36e7d..21078f1a4 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-10-26T23:53:51Z
+Expires: 2027-10-27T00:05:44Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/blog/2024/02/apache-shiro-200-released.html
b/blog/2024/02/apache-shiro-200-released.html
index d08bec841..d0e20af71 100644
--- a/blog/2024/02/apache-shiro-200-released.html
+++ b/blog/2024/02/apache-shiro-200-released.html
@@ -248,7 +248,7 @@ This is the first major release for Shiro 2.x</p>
<p>SpringBoot 3.x support (SpringBoot 2.x is also supported)</p>
</li>
<li>
-<p>Automatic form resubmission when session expired (Jakarta EE only)</p>
+<p>Saving form data to prevent data loss when session expires (Jakarta EE
only)</p>
</li>
</ul>
</div>
diff --git a/feed.xml b/feed.xml
index 73d597563..4ff0f0b32 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-10-26T23:53:51Z</updated>
+ <updated>2026-10-27T00:05:44Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/jakarta-ee.html b/jakarta-ee.html
index 28f110422..8c6a070e5 100644
--- a/jakarta-ee.html
+++ b/jakarta-ee.html
@@ -840,7 +840,29 @@ To disable the no-login recovery for visitors who are not
signed in while keepin
</div>
</div>
<div class="paragraph">
-<p>If a saved submission cannot be completed after login, Shiro returns the
user to the original page.</p>
+<p>If the page doesn’t require login, and the user is remembered or
anonymous, the form is submitted right away without any login or "session
expired" page. This does not apply to client-side Faces state saving, where the
view state is not lost with the session.</p>
+</div>
+<div class="listingblock">
+<div class="title">To limit this to remembered users only, add the following
to <code>web.xml</code>:</div>
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-xml hljs"
data-lang="xml"><context-param>
+
<param-name>org.apache.shiro.form-resubmit.anonymous.disabled</param-name>
+ <param-value>true</param-value>
+</context-param></code></pre>
+</div>
+</div>
+<div class="listingblock">
+<div class="title">To re-render only the form’s own render targets
instead, add the following to <code>web.xml</code>:</div>
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-xml hljs"
data-lang="xml"><context-param>
+
<param-name>org.apache.shiro.form-resubmit.ajax-render-all.disabled</param-name>
+ <param-value>true</param-value>
+</context-param></code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>Components outside those targets, and other forms on the page, may then
keep their pre-expiry state.
+If a saved submission cannot be completed after login, Shiro returns the user
to the original page.</p>
</div>
<div class="admonitionblock note">
<table>
@@ -871,7 +893,18 @@ Leave Shiro’s <code>filterOncePerRequest</code>
disabled.
<p>Alternatively, you can set
<code>org.apache.shiro.form-resubmit.secure-cookies</code> system property in
the same manner as above.</p>
</div>
<div class="paragraph">
-<p>The <code>org.apache.shiro.form-resubmit-host</code> and
<code>org.apache.shiro.form-resubmit-port</code> system properties used by
older releases are no longer needed or used.</p>
+<p>To tell users that their form data was saved, and let them discard it
(useful on shared browsers), add the following inside the login form:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-xml hljs"
data-lang="xml">xmlns:shiro="http://shiro.apache.org/tags";
+...
+<shiro:formDataNotice/></code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>The <code>message</code> and <code>discardLabel</code> attributes override
the default wording.
+The <code>org.apache.shiro.form-resubmit-host</code> and
<code>org.apache.shiro.form-resubmit-port</code> system properties used by
older releases are no longer needed or used.</p>
</div>
</div>
<div class="sect3">
