Apache Shiro Documentation

repository·main·Indexed 26 days ago

https://github.com/apache/shiro

A comprehensive Java security framework that simplifies authentication, authorization, cryptography, and session management. It supports various application types, including mobile and enterprise web applications, and provides enhanced integration for the Jakarta EE stack via Shiro-EE for CDI and EJB environments.

Tokens
1.1K
Snippets
10
Records
13
Agent score
87%

What's inside Apache Shiro

  1. Overview of Apache Shiro

    main

    Apache Shiro is a Java security framework designed to handle four primary security tasks:

    1. Authentication: Verifying user identity (e.g., login).
    2. Authorization: Determining if a user has permission to perform a specific action or access a resource.
    3. Cryptography: Providing support for encryption, hashing, and other cryptographic operations.
    4. Session Management: Managing user sessions (including web sessions) without requiring a web container.

    It is designed to be easy to use across various application types, from mobile to large-scale enterprise web applications.

  2. Overview of Shiro-EE feature set

    main

    Shiro-EE provides enhanced integration for the Jakarta EE stack, offering features that extend standard Shiro capabilities specifically for CDI and EJB environments. Key capabilities include:

    • Bean Protection: Annotate CDI and EJB (local & remote) beans with @RequiresXXX to enforce security constraints.
    • Session Integration: Use CDI @SessionScoped or @ViewScoped beans within Shiro-native sessions.
    • Zero-Config Web Setup: Automatically configure Shiro without requiring entries in web.xml via Context listeners.
    • Form Data Persistence: Automatic prevention of form data loss when a session expires.
    • JSF Enhancements:
      • Automatic SSL filter toggling based on JSF production/development modes.
      • Automatic mitigation of ViewExpiredException.
      • Support for both JSF Client state saving and Server state saving.
    • Proxy Awareness: Automatic handling of SSL URLs when the application is proxied via HAProxy or Apache.
  3. Run the Apache Shiro + Spring Web Example

    main

    To run the demonstration web application (WAR packaged) which shows how to configure Apache Shiro via Spring and includes a Spring Remoting example, use Maven to run the Jetty server.

    After running the command, the application will be available at http://localhost:8080/shiro-samples-spring.

    mvn jetty:run
  4. Run the Apache Shiro Web Example

    main

    This sample project demonstrates how to configure Apache Shiro in a web application using web.xml and implements basic user login functionality. To run the example application using Maven and the Jetty plugin, execute the following command in your terminal:

    mvn jetty:run
  5. Run the Apache Shiro + Spring Web + Hibernate Example

    main

    To run the Spring Boot example web application demonstrating user login with Spring and Hibernate, use the Maven Jetty plugin from the project root.

    After running the command, the application will be available at http://localhost:9080/.

    mvn jetty:run
  6. Run the Apache Shiro + Spring Boot CLI Example

    main

    This sample project demonstrates how to use Apache Shiro within a Spring Boot CLI application. It covers common security tasks including user login, permission checking, and protecting methods using annotations. To run the example application, use the Maven Spring Boot plugin.

    mvn spring-boot:run