This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new 40718e282 enh: document secure session cookie configuration for
Jakarta EE
40718e282 is described below
commit 40718e28282cd8bbdb035fa576542e3a1ad71ce3
Author: lprimak <[email protected]>
AuthorDate: Thu Apr 30 23:27:08 2026 -0500
enh: document secure session cookie configuration for Jakarta EE
---
src/site/content/jakarta-ee.adoc | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc
index dce8c9aed..aa93297a1 100644
--- a/src/site/content/jakarta-ee.adoc
+++ b/src/site/content/jakarta-ee.adoc
@@ -222,6 +222,18 @@ The module adds `ShiroFilter` to the Servlet
configuration. For most cases, the
</filter-mapping>
... other filters ...
----
+Ordinarily, Shiro sets session cookies to be secure, unless you are in Jakarta
Faces' Development mode.
+Make sure to run in other than Development mode in production, so that secure
cookies are used.
+If secure session cookies are not desired, you can disable them by adding the
following to `web.xml`:
+[source,xml]
+.Note: this parameter is only available in Shiro 2.1.1 or later
+----
+<context-param>
+ <param-name>org.apache.shiro.ee.secure-session-cookie.disabled</param-name>
+ <param-value>true</param-value>
+</context-param>
+----
+
Ordinarily, Jakarta EE integration module will remove URL session tracking
mode from the configuration, overriding any other session tracking
configuration specified in `web.xml`. This is to align with good security
practices. If URL tracking mode is desired (such as for testing or historical
reasons), add the following to `web.xml`:
[source,xml]
.Note: this parameter is only available in Shiro 2.0.6 or later
