This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts-examples.git
The following commit(s) were added to refs/heads/main by this push:
new b8b977a Fix broken login flow in shiro-basic example (#545)
b8b977a is described below
commit b8b977ab44ae2658d737e418507559857e627089
Author: Lukasz Lenart <[email protected]>
AuthorDate: Fri Aug 14 14:23:51 2026 +0200
Fix broken login flow in shiro-basic example (#545)
The example was unusable: every request redirected to Shiro's default
loginUrl of /login.jsp, which does not exist here, producing an infinite
redirect loop. shiro.ini defined only [users] and [roles], so no filter
chain was configured and Shiro protected every path including the login
page and the form it posts to. Because shiroFilter is mapped for FORWARD
as well as REQUEST, the JSPs the Struts actions forward to were caught
too, so listing only the actions would not have been enough.
Adds a [main] section pointing authc at the login action, and a [urls]
chain leaving the login path anonymous while protecting the rest.
Separately, the container rewrote redirect URLs as ...;jsessionid=... on
a visitor's first request, and Jetty 11 rejects its own rewritten URI
with HTTP 400 Invalid request. Restricting session tracking to cookies
stops the rewriting.
Verified in a browser and over HTTP: login as lonestarr renders the
welcome page with roles and permissions resolved, logout returns to the
login page, and welcome.action is no longer reachable afterwards.
Co-authored-by: Claude Opus 5 <[email protected]>
---
shiro-basic/src/main/resources/shiro.ini | 28 +++++++++++++++++++++++++++-
shiro-basic/src/main/webapp/WEB-INF/web.xml | 8 ++++++++
2 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/shiro-basic/src/main/resources/shiro.ini
b/shiro-basic/src/main/resources/shiro.ini
index 436c465..dec7d78 100644
--- a/shiro-basic/src/main/resources/shiro.ini
+++ b/shiro-basic/src/main/resources/shiro.ini
@@ -4,6 +4,17 @@
# Usernames/passwords are based on the classic Mel Brooks' film "Spaceballs" :)
# =============================================================================
+# -----------------------------------------------------------------------------
+# Shiro objects and settings
+#
+# This example authenticates programmatically in LoginAction rather than
letting
+# Shiro's form filter do it, so authc only needs to know where to send an
+# unauthenticated visitor. Shiro's default is /login.jsp, which does not exist
+# here — the login form is rendered by the "login" Struts action.
+# -----------------------------------------------------------------------------
+[main]
+authc.loginUrl = /login.action
+
# -----------------------------------------------------------------------------
# Users and their (optional) assigned roles
# username = password, role1, role2, ..., roleN
@@ -22,4 +33,19 @@ lonestarr = vespa, goodguy, schwartz
[roles]
admin = *
schwartz = lightsaber:*
-goodguy = winnebago:drive:eagle5
\ No newline at end of file
+goodguy = winnebago:drive:eagle5
+
+# -----------------------------------------------------------------------------
+# Filter chain, evaluated top-down — the first matching path wins.
+#
+# Without this section Shiro protects every path, including the login page and
+# the form it posts to, which leaves an unauthenticated visitor in a redirect
+# loop. Note that shiroFilter is mapped for FORWARD as well as REQUEST, so the
+# JSPs the Struts actions forward to must be listed too, not just the actions.
+# -----------------------------------------------------------------------------
+[urls]
+/index.jsp = anon
+/login.action = anon
+/authuser.action = anon
+/pages/login.jsp = anon
+/** = authc
\ No newline at end of file
diff --git a/shiro-basic/src/main/webapp/WEB-INF/web.xml
b/shiro-basic/src/main/webapp/WEB-INF/web.xml
index 7cfbe3e..4bad1e4 100644
--- a/shiro-basic/src/main/webapp/WEB-INF/web.xml
+++ b/shiro-basic/src/main/webapp/WEB-INF/web.xml
@@ -4,6 +4,14 @@
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee
https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd";
version="6.0">
<display-name>struts2shiro</display-name>
+
+ <!-- Track sessions with a cookie only. Without this the container rewrites
+ redirect URLs as ...;jsessionid=... on a visitor's first request, and
+ Jetty 11 rejects its own rewritten URI with HTTP 400 Invalid request.
-->
+ <session-config>
+ <tracking-mode>COOKIE</tracking-mode>
+ </session-config>
+
<listener>
<listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>
