[ https://issues.apache.org/jira/browse/SHIRO-792?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ricardo Mendes updated SHIRO-792: --------------------------------- Description: I'm using {{shiro-spring-boot-web-starter 1.6.0}} within a web application developed with {{Spring Boot v2.3.2.RELEASE}}. When I add one or more filters to the application using {{@Bean}}/{{FilterRegistrationBean}} (example below), the Shiro filter is not properly loaded anymore, and all requests that depend on {{SecurityUtils}} to be fulfilled start to fail. {code:java} @Bean public FilterRegistrationBean<LogoutFilter> logoutFilter() { final FilterRegistrationBean<LogoutFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.addUrlPatterns("/security/logout"); registrationBean.setFilter(new LogoutFilter()); registrationBean.setName("logoutFilter"); return registrationBean; } {code} I ran some tests to figure out what's going on and it turns out the {{@ConditionalOnMissingBean}} used to annotate {{filterShiroFilterRegistrationBean()}} [here|https://github.com/apache/shiro/blob/shiro-root-1.6.0/support/spring-boot/spring-boot-web-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java#L48] seems to be the culprit: the condition evaluates to false when there are more {{FilterRegistrationBean}}'s annotated with {{@ConditionalOnMissingBean}} in the application, so the method is not called, and hence the Shiro filter is not loaded. As a workaround, I've added the below configuration to the application and now everything works fine: {code:java} @Configuration public class ShiroWebFilterConfig extends AbstractShiroWebFilterConfiguration { @Bean protected FilterRegistrationBean<AbstractShiroFilter> shiroFilter() throws Exception { final FilterRegistrationBean<AbstractShiroFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.setDispatcherTypes(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR); registrationBean.setFilter((AbstractShiroFilter) shiroFilterFactoryBean().getObject()); registrationBean.setOrder(1); return registrationBean; } } {code} Makes sense? Kind regards, Ricardo. was: I'm using {{shiro-spring-boot-web-starter 1.6.0}} within a web application developed with {{Spring Boot v2.3.2.RELEASE}}. When I add one or more filters to the application using {{@Bean}}/{{FilterRegistrationBean}} (example below), the Shiro filter is not properly loaded anymore, and all requests that depend on SecurityUtils to be fulfilled start to fail. {code:java} @Bean public FilterRegistrationBean<LogoutFilter> logoutFilter() { final FilterRegistrationBean<LogoutFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.addUrlPatterns("/security/logout"); registrationBean.setFilter(new LogoutFilter()); registrationBean.setName("logoutFilter"); return registrationBean; } {code} I ran some tests to figure out what's going on and it turns out the {{@ConditionalOnMissingBean}} used to annotate {{filterShiroFilterRegistrationBean()}} [here|https://github.com/apache/shiro/blob/shiro-root-1.6.0/support/spring-boot/spring-boot-web-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java#L48] seems to be the culprit: the condition evaluates to false when there are more {{FilterRegistrationBean}}'s annotated with {{@ConditionalOnMissingBean}} in the application, so the method is not called, and hence the Shiro filter is not loaded. As a workaround, I've added the below configuration to the application and now everything works fine: {code:java} @Configuration public class ShiroWebFilterConfig extends AbstractShiroWebFilterConfiguration { @Bean protected FilterRegistrationBean<AbstractShiroFilter> shiroFilter() throws Exception { final FilterRegistrationBean<AbstractShiroFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.setDispatcherTypes(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR); registrationBean.setFilter((AbstractShiroFilter) shiroFilterFactoryBean().getObject()); registrationBean.setOrder(1); return registrationBean; } } {code} Makes sense? Kind regards, Ricardo. > ShiroWebFilterConfiguration seems to conflict with other > FilterRegistrationBean > ------------------------------------------------------------------------------- > > Key: SHIRO-792 > URL: https://issues.apache.org/jira/browse/SHIRO-792 > Project: Shiro > Issue Type: Bug > Components: Integration: Spring > Affects Versions: 1.6.0 > Reporter: Ricardo Mendes > Assignee: Les Hazlewood > Priority: Major > > I'm using {{shiro-spring-boot-web-starter 1.6.0}} within a web application > developed with {{Spring Boot v2.3.2.RELEASE}}. > When I add one or more filters to the application using > {{@Bean}}/{{FilterRegistrationBean}} (example below), the Shiro filter is not > properly loaded anymore, and all requests that depend on {{SecurityUtils}} to > be fulfilled start to fail. > {code:java} > @Bean > public FilterRegistrationBean<LogoutFilter> logoutFilter() { > final FilterRegistrationBean<LogoutFilter> registrationBean = new > FilterRegistrationBean<>(); > registrationBean.addUrlPatterns("/security/logout"); > registrationBean.setFilter(new LogoutFilter()); > registrationBean.setName("logoutFilter"); > return registrationBean; > } > {code} > I ran some tests to figure out what's going on and it turns out the > {{@ConditionalOnMissingBean}} used to annotate > {{filterShiroFilterRegistrationBean()}} > [here|https://github.com/apache/shiro/blob/shiro-root-1.6.0/support/spring-boot/spring-boot-web-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java#L48] > seems to be the culprit: the condition evaluates to false when there are > more {{FilterRegistrationBean}}'s annotated with > {{@ConditionalOnMissingBean}} in the application, so the method is not > called, and hence the Shiro filter is not loaded. > As a workaround, I've added the below configuration to the application and > now everything works fine: > {code:java} > @Configuration > public class ShiroWebFilterConfig extends AbstractShiroWebFilterConfiguration > { > @Bean > protected FilterRegistrationBean<AbstractShiroFilter> shiroFilter() throws > Exception { > final FilterRegistrationBean<AbstractShiroFilter> registrationBean = new > FilterRegistrationBean<>(); > registrationBean.setDispatcherTypes(DispatcherType.REQUEST, > DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR); > registrationBean.setFilter((AbstractShiroFilter) > shiroFilterFactoryBean().getObject()); > registrationBean.setOrder(1); > return registrationBean; > } > } > {code} > Makes sense? > Kind regards, Ricardo. -- This message was sent by Atlassian Jira (v8.3.4#803005)