(shiro) branch main updated: enh(jakarta-ee): added secure configuration for session cookies automatically

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git


The following commit(s) were added to refs/heads/main by this push:
     new 80f635c51 enh(jakarta-ee): added secure configuration for session 
cookies automatically
80f635c51 is described below

commit 80f635c5180c7cf562fed4cab7099072ab21bd10
Author: lprimak <le...@flowlogix.com>
AuthorDate: Thu Apr 30 23:29:01 2026 -0500

    enh(jakarta-ee): added secure configuration for session cookies 
automatically
---
 .../apache/shiro/ee/listeners/EnvironmentLoaderListener.java   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git 
a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
 
b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
index d7352688b..bc5935160 100644
--- 
a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
+++ 
b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
@@ -43,6 +43,8 @@ public class EnvironmentLoaderListener extends 
EnvironmentLoader implements Serv
     private static final String SHIRO_EE_ENABLE_URL_SESSION_TRACKING_PARAM = 
"org.apache.shiro.ee.enable-url-session-tracking";
     private static final String 
SHIRO_EE_SESSION_TRACKING_CONFIGURATION_DISABLED_PARAM =
             "org.apache.shiro.ee.session-tracking-configuration.disabled";
+    private static final String SHIRO_EE_DISABLE_SECURE_SESSION_COOKIE_PARAM =
+            "org.apache.shiro.ee.secure-session-cookie.disabled";
     private static final String SHIRO_EE_DISABLE_CHAR_ENCODING_PARAM = 
"org.apache.shiro.ee.disable-character-encoding";
     private static final String SHIRO_EE_CHAR_ENCODING_PARAM = 
"org.apache.shiro.ee.character-encoding";
     private static final String FORM_RESUBMIT_DISABLED_PARAM = 
"org.apache.shiro.form-resubmit.disabled";
@@ -112,6 +114,7 @@ public class EnvironmentLoaderListener extends 
EnvironmentLoader implements Serv
                     
.getInitParameter(SHIRO_EE_SESSION_TRACKING_CONFIGURATION_DISABLED_PARAM))) {
                 modifySessionTrackingConfiguration(sce);
             }
+            modifySecureSessionConfiguration(sce);
 
             WebEnvironment environment = 
initEnvironment(sce.getServletContext());
             if (hasFacesContext() && Faces.isDevelopment()
@@ -152,4 +155,11 @@ public class EnvironmentLoaderListener extends 
EnvironmentLoader implements Serv
         }
         sce.getServletContext().setSessionTrackingModes(effectiveModes);
     }
+
+    private void modifySecureSessionConfiguration(ServletContextEvent sce) {
+        if 
(!Boolean.parseBoolean(sce.getServletContext().getInitParameter(SHIRO_EE_DISABLE_SECURE_SESSION_COOKIE_PARAM))
+                && !hasFacesContext() || !Faces.isDevelopment()) {
+            sce.getServletContext().getSessionCookieConfig().setSecure(true);
+        }
+    }
 }