Great! The below message is a warning, and it’s normal when existing users’ encryption key doesn’t match the new key. New key is generated by default on every restart.
Perhaps this warning is not the best in the world, feel free to open an issue to have it improved. > On Sep 3, 2026, at 9:07 PM, Maxim Solodovnik <[email protected]> wrote: > > Thanks a million, that was the case! > > I was able to (mostly fix the examples :))) > > The only error I have no idea how to fix remain is: > > WARN - DefaultSecurityManager - Delegate RememberMeManager > instance of type [org.apache.shiro.web.mgt.CookieRememberMeManager] > threw an exception during getRememberedPrincipals(). > org.apache.shiro.crypto.CryptoException: Unable to execute 'doFinal' > with cipher instance [Cipher.AES/GCM/NoPadding, mode: decryption, > algorithm from: SunJCE]. > at > org.apache.shiro.crypto.cipher.JcaCipherService.crypt(JcaCipherService.java:469) > at > org.apache.shiro.crypto.cipher.JcaCipherService.crypt(JcaCipherService.java:452) > at > org.apache.shiro.crypto.cipher.JcaCipherService.decryptInternal(JcaCipherService.java:397) > at > org.apache.shiro.crypto.cipher.JcaCipherService.decryptInternal(JcaCipherService.java:389) > at > org.apache.shiro.crypto.cipher.SimpleByteSourceBroker.getClonedBytes(SimpleByteSourceBroker.java:61) > at > org.apache.shiro.mgt.AbstractRememberMeManager.decrypt(AbstractRememberMeManager.java:591) > at > org.apache.shiro.mgt.AbstractRememberMeManager.convertBytesToPrincipals(AbstractRememberMeManager.java:505) > at > org.apache.shiro.mgt.AbstractRememberMeManager.getRememberedPrincipals(AbstractRememberMeManager.java:470) > at > org.apache.shiro.mgt.DefaultSecurityManager.getRememberedIdentity(DefaultSecurityManager.java:645) > at > org.apache.shiro.mgt.DefaultSecurityManager.resolvePrincipals(DefaultSecurityManager.java:529) > at > org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:373) > at org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:856) > at > org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:148) > at > org.apache.shiro.web.servlet.AbstractShiroFilter.createSubject(AbstractShiroFilter.java:305) > at > org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:373) > at > org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:156) > at > org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:208) > at > org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) > at > org.eclipse.jetty.ee10.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:199) > at > org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205) > at > org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) > at > org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1556) > at > org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:871) > at > org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:449) > at > org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469) > at > org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:546) > at > org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:719) > at > org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1253) > at > org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:148) > at org.eclipse.jetty.server.Server.handle(Server.java:197) > at > org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:804) > at > org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420) > at > org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1790) > at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) > at > org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54) > at > org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009) > at > org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1240) > at > org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194) > at java.base/java.lang.Thread.run(Thread.java:1583) > Caused by: javax.crypto.AEADBadTagException: Tag mismatch > at > java.base/com.sun.crypto.provider.GaloisCounterMode$GCMDecrypt.doFinal(GaloisCounterMode.java:1545) > at > java.base/com.sun.crypto.provider.GaloisCounterMode.engineDoFinal(GaloisCounterMode.java:417) > at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2265) > at > org.apache.shiro.crypto.cipher.JcaCipherService.crypt(JcaCipherService.java:466) > ... 38 more > > On Thu, 3 Sept 2026 at 21:23, Lenny Primak <[email protected]> wrote: >> >> Hi, Maxim, >> >> I believe you are hitting the “hardened by default” changes in 3.x >> See https://shiro.apache.org/migration-guide.html#security-behavior-changes >> for more information. >> Or you can manually update your security configuration to include /** = anon >> at the end although I would not recommend this in production. >> >> On Sep 2, 2026, at 10:15 PM, Maxim Solodovnik <[email protected]> wrote: >> >> Hello All, >> >> I'm trying to migrate org.wicketstuff:wicketstuff-shiro to Shiro v3 >> The build is green, all looks good >> >> BUT :) >> for whatever reason examples are not working :( >> What I can see is >> >> Many blocks like >> ``` >> DEBUG [org.apache.shiro.web.filter.authc.NoAccessFilter] - Blocking >> access to request: '/account/login' >> ``` >> And "Too many redirects" in the browser >> >> Maybe someone can help to update `shiro-example-*` too some working state? :) >> >> My migration branch is here: https://github.com/wicketstuff/core/pull/1543 >> >> I was able to make `wicket-shiro-example-realm` working >> Others are broken :( >> >> I was trying to debug `wicket-shiro-example-spring-hibernate-native` >> (it has DEBUG/TRACE logs) >> without any luck :( >> >> I would appreciate your help :) >> >> -- >> Best regards, >> Maxim >> >> > > > -- > Best regards, > Maxim
