This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new ae16f3a81 content update 4/30/2026
ae16f3a81 is described below
commit ae16f3a81f65bc131a646de084f6e4cceae7dcbf
Author: lprimak <[email protected]>
AuthorDate: Thu Apr 30 10:47:10 2026 -0500
content update 4/30/2026
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
jakarta-ee.html | 8 ++++++++
spring-boot.html | 4 ++--
spring-framework.html | 4 ++--
troubleshooting.html | 21 +++++++++++++++++++++
6 files changed, 35 insertions(+), 6 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 4decccb60..dba778917 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-04-29T22:58:09Z
+Expires: 2027-04-30T15:35:49Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index a4ec72a83..bac4ca961 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-04-29T22:58:09Z</updated>
+ <updated>2026-04-30T15:35:50Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/jakarta-ee.html b/jakarta-ee.html
index 651dd6b6c..45f8322a3 100644
--- a/jakarta-ee.html
+++ b/jakarta-ee.html
@@ -638,6 +638,14 @@ Any Shiro principal object can be injected if annotated by
<code>@Principal</cod
<pre class="highlightjs highlight"><code class="language-properties hljs"
data-lang="properties">authc.useRemembered = true</code></pre>
</div>
</div>
+<div class="paragraph">
+<p>RememberMe uses secure cookies by default. If you are running in non-HTTPS
environment, you can disable secure cookies in Jakarta Faces' development mode
only by adding the following to <code>shiro.ini</code> (this is the recommended
configuration, but make sure production is running in Faces production
mode):</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-properties hljs"
data-lang="properties">securityManager.rememberMeManager.secureInDevMode =
false</code></pre>
+</div>
+</div>
</div>
<div class="sect3">
<h4 id="rate_limiting">Rate limiting: Automatic delay when login failed</h4>
diff --git a/spring-boot.html b/spring-boot.html
index e9750dc50..678c27660 100644
--- a/spring-boot.html
+++ b/spring-boot.html
@@ -587,12 +587,12 @@ protected CacheManager cacheManager() {
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p
class="tableblock">shiro.rememberMeManager.cookie.path</p></td>
-<td class="tableblock halign-left valign-top"><p
class="tableblock">null</p></td>
+<td class="tableblock halign-left valign-top"><p
class="tableblock">ROOT_PATH</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">RememberMe
cookie path</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p
class="tableblock">shiro.rememberMeManager.cookie.secure</p></td>
-<td class="tableblock halign-left valign-top"><p
class="tableblock"><code>false</code></p></td>
+<td class="tableblock halign-left valign-top"><p
class="tableblock"><code>true</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">RememberMe
cookie secure flag</p></td>
</tr>
<tr>
diff --git a/spring-framework.html b/spring-framework.html
index 9a30e5830..b05122dbd 100644
--- a/spring-framework.html
+++ b/spring-framework.html
@@ -891,12 +891,12 @@ age</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p
class="tableblock">shiro.rememberMeManager.cookie.path</p></td>
-<td class="tableblock halign-left valign-top"><p
class="tableblock">null</p></td>
+<td class="tableblock halign-left valign-top"><p
class="tableblock">ROOT_PATH</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">RememberMe
cookie path</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p
class="tableblock">shiro.rememberMeManager.cookie.secure</p></td>
-<td class="tableblock halign-left valign-top"><p
class="tableblock"><code>false</code></p></td>
+<td class="tableblock halign-left valign-top"><p
class="tableblock"><code>true</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">RememberMe
cookie
secure flag</p></td>
</tr>
diff --git a/troubleshooting.html b/troubleshooting.html
index cd4feaa2f..8f7111126 100644
--- a/troubleshooting.html
+++ b/troubleshooting.html
@@ -917,6 +917,27 @@ subject.isRemembered();</code></pre>
</div>
</div>
</li>
+<li>
+<p><strong>Browser cookie issues</strong>: Ensure the browser accepts cookies
and that there are no domain/path mismatches.
+By default, Shiro’s Remember Me cookie is HTTP-only and secure. If
you’re testing in a non-HTTPS environment, you may need to adjust the
secure flag for testing purposes.
+You can use system property to control this behavior. Set
<code>org.apache.shiro.rememberMe.secure.disabled</code> to <code>true</code>
to disable the secure flag on the Remember Me cookie for testing.
+You can also configure this in your <code>shiro.ini</code>:</p>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">[main]
+securityManager.rememberMeManager.cookie.secure = false</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>For Jakarta EE applications, the secure flag is enabled by default. You can
disable it for testing purposes in Jakarta Faces' Development mode only by
setting the following in your shiro.ini:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">[main]
+securityManager.rememberMeManager.secureInDevMode = false</code></pre>
+</div>
+</div>
+</li>
</ol>
</div>
</div>
