This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git
The following commit(s) were added to refs/heads/main by this push:
new c95a185e6 enh: reverted secureInDevMode addition and added native
session management secure cookie Secure session and rememberMe cookies are
turned off is the initial request that created them is insecure
c95a185e6 is described below
commit c95a185e6ed2b4668ab25e6313717e6e1182a2b9
Author: lprimak <[email protected]>
AuthorDate: Sat May 2 23:47:03 2026 -0500
enh: reverted secureInDevMode addition and added native session management
secure cookie
Secure session and rememberMe cookies are turned off is the initial request
that created them is insecure
---
.../shiro/session/mgt/DefaultSessionManager.java | 1 +
.../ee/listeners/EnvironmentLoaderListener.java | 17 ++----------
.../web/config/AbstractShiroWebConfiguration.java | 4 +--
.../shiro/web/mgt/CookieRememberMeManager.java | 32 ++--------------------
.../org/apache/shiro/web/servlet/SimpleCookie.java | 2 +-
.../web/session/mgt/DefaultWebSessionManager.java | 3 ++
.../mgt/DefaultWebSessionManagerTest.groovy | 8 +++++-
7 files changed, 18 insertions(+), 49 deletions(-)
diff --git
a/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java
b/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java
index 604a9de42..7844b5929 100644
--- a/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java
+++ b/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java
@@ -39,6 +39,7 @@ import java.util.Date;
* @since 0.1
*/
public class DefaultSessionManager extends AbstractValidatingSessionManager
implements CacheManagerAware {
+ public static final String SECURE_COOKIE_DISABLED =
"org.apache.shiro.cookie.secure.disabled";
private static final Logger LOGGER =
LoggerFactory.getLogger(DefaultSessionManager.class);
diff --git
a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
index bc5935160..33cf25c4a 100644
---
a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
+++
b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/listeners/EnvironmentLoaderListener.java
@@ -24,11 +24,8 @@ import javax.servlet.ServletContextListener;
import javax.servlet.SessionTrackingMode;
import javax.servlet.annotation.WebListener;
-import org.apache.shiro.SecurityUtils;
-import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.web.env.EnvironmentLoader;
import org.apache.shiro.web.env.WebEnvironment;
-import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.omnifaces.util.Faces;
import static org.apache.shiro.ee.listeners.IniEnvironment.hasFacesContext;
@@ -114,19 +111,9 @@ public class EnvironmentLoaderListener extends
EnvironmentLoader implements Serv
.getInitParameter(SHIRO_EE_SESSION_TRACKING_CONFIGURATION_DISABLED_PARAM))) {
modifySessionTrackingConfiguration(sce);
}
- modifySecureSessionConfiguration(sce);
- WebEnvironment environment =
initEnvironment(sce.getServletContext());
- if (hasFacesContext() && Faces.isDevelopment()
- &&
SecurityUtils.unwrapSecurityManager(environment.getWebSecurityManager(),
DefaultSecurityManager.class)
- .getRememberMeManager() instanceof
CookieRememberMeManager) {
- var rememberMeManager = (CookieRememberMeManager) SecurityUtils
-
.unwrapSecurityManager(environment.getWebSecurityManager(),
DefaultSecurityManager.class)
- .getRememberMeManager();
- if (!rememberMeManager.isSecureInDevMode()) {
- rememberMeManager.getCookie().setSecure(false);
- }
- }
+ modifySecureSessionConfiguration(sce);
+ initEnvironment(sce.getServletContext());
}
}
diff --git
a/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java
b/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java
index 6c73448f1..aee139dee 100644
---
a/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java
+++
b/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java
@@ -61,10 +61,10 @@ public class AbstractShiroWebConfiguration extends
AbstractShiroConfiguration {
@Value("#{ @environment['shiro.sessionManager.cookie.domain'] ?: null }")
protected String sessionIdCookieDomain;
- @Value("#{ @environment['shiro.sessionManager.cookie.path'] ?: null }")
+ @Value("#{ @environment['shiro.sessionManager.cookie.path'] ?:
T(org.apache.shiro.web.servlet.Cookie).ROOT_PATH }")
protected String sessionIdCookiePath;
- @Value("#{ @environment['shiro.sessionManager.cookie.secure'] ?: false }")
+ @Value("#{ @environment['shiro.sessionManager.cookie.secure'] ?: true }")
protected boolean sessionIdCookieSecure;
@Value("#{ @environment['shiro.sessionManager.cookie.sameSite'] ?:"
diff --git
a/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java
b/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java
index 7e58d1e11..cc50bd95c 100644
--- a/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java
+++ b/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java
@@ -36,6 +36,7 @@ import org.slf4j.LoggerFactory;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import static
org.apache.shiro.session.mgt.DefaultSessionManager.SECURE_COOKIE_DISABLED;
/**
@@ -76,12 +77,10 @@ public class CookieRememberMeManager extends
AbstractRememberMeManager {
* The default name of the underlying rememberMe cookie which is {@code
rememberMe}.
*/
public static final String DEFAULT_REMEMBER_ME_COOKIE_NAME = "rememberMe";
- public static final String REMEMBER_ME_SECURE_COOKIE_DISABLED =
"org.apache.shiro.rememberMe.secure.disabled";
private static final Logger LOGGER =
LoggerFactory.getLogger(CookieRememberMeManager.class);
private Cookie cookie;
- private boolean secureInDevMode = true;
/**
* Constructs a new {@code CookieRememberMeManager} with a default {@code
rememberMe} cookie template.
@@ -130,33 +129,6 @@ public class CookieRememberMeManager extends
AbstractRememberMeManager {
this.cookie = cookie;
}
- /**
- * Returns {@code true} if the rememberMe cookie should be marked as
secure when the application is running in
- * development mode. This is a convenience method that allows users to
set the rememberMe cookie as secure in
- * production environments but not in development environments where SSL
is often not used.
- * The default value is {@code true}.
- * @return {@code true} if the rememberMe cookie should be marked as
secure when the application is running in
- * development mode, {@code false} otherwise (the default value is {@code
true}).
- * @since 2.1.1
- */
- @SuppressWarnings("UnusedDeclaration")
- public boolean isSecureInDevMode() {
- return secureInDevMode;
- }
-
- /**
- * Sets whether the rememberMe cookie should be marked as secure when the
application is running in development mode.
- * This is a convenience method that allows users to set the rememberMe
cookie as secure in production environments but not
- * in development environments where SSL is often not used. The default
value is {@code true}.
- * @param secureInDevMode set to {@code true} if the rememberMe cookie
should be marked as secure when the
- * application is running in development mode, {@code false} otherwise
(the default value is {@code true}).
- * @since 2.1.1
- */
- @SuppressWarnings("UnusedDeclaration")
- public void setSecureInDevMode(boolean secureInDevMode) {
- this.secureInDevMode = secureInDevMode;
- }
-
/**
* Base64-encodes the specified serialized byte array and sets that
base64-encoded String as the cookie value.
* <p/>
@@ -342,7 +314,7 @@ public class CookieRememberMeManager extends
AbstractRememberMeManager {
private Cookie createDefaultCookie() {
Cookie cookie = new SimpleCookie(DEFAULT_REMEMBER_ME_COOKIE_NAME);
cookie.setHttpOnly(true);
- if (!Boolean.getBoolean(REMEMBER_ME_SECURE_COOKIE_DISABLED)) {
+ if (!Boolean.getBoolean(SECURE_COOKIE_DISABLED)) {
cookie.setSecure(true);
}
//One year should be long enough - most sites won't object to
requiring a user to log in if they haven't visited
diff --git a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java
b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java
index 558346a96..db895ad20 100644
--- a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java
+++ b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java
@@ -250,7 +250,7 @@ public class SimpleCookie implements Cookie {
String path = calculatePath(request);
int maxAge = getMaxAge();
int version = getVersion();
- boolean secure = isSecure();
+ boolean secure = isSecure() && request.isSecure();
boolean httpOnly = isHttpOnly();
SameSiteOptions sameSite = getSameSite();
diff --git
a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
index 709c15862..d927f2ab9 100644
---
a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
+++
b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
@@ -57,6 +57,9 @@ public class DefaultWebSessionManager extends
DefaultSessionManager implements W
Cookie cookie = new
SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
//more secure, protects against XSS attacks
cookie.setHttpOnly(true);
+ if (!Boolean.getBoolean(SECURE_COOKIE_DISABLED)) {
+ cookie.setSecure(true);
+ }
this.sessionIdCookie = cookie;
this.sessionIdCookieEnabled = true;
this.sessionIdUrlRewritingEnabled = false;
diff --git
a/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
b/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
index 4b0895c7c..e57ff8306 100644
---
a/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
+++
b/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
@@ -65,7 +65,8 @@ public class DefaultWebSessionManagerTest {
session.setId("12345");
WebSessionContext wsc = new DefaultWebSessionContext();
- wsc.setServletRequest(createMock(HttpServletRequest.class));
+ HttpServletRequest servletRequest =
createMock(HttpServletRequest.class);
+ wsc.setServletRequest(servletRequest);
wsc.setServletResponse(createMock(HttpServletResponse.class));
//test that the cookie template is being used:
@@ -77,10 +78,15 @@ public class DefaultWebSessionManagerTest {
expect(cookie.getPath()).andReturn("/");
expect(cookie.getVersion()).andReturn(SimpleCookie.DEFAULT_VERSION);
expect(cookie.isSecure()).andReturn(true);
+ expect(servletRequest.isSecure()).andReturn(true);
expect(cookie.isHttpOnly()).andReturn(true);
expect(cookie.getSameSite()).andReturn(Cookie.SameSiteOptions.LAX);
+
servletRequest.removeAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE);
+
servletRequest.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_IS_NEW,
Boolean.TRUE);
+
replay(cookie);
+ replay(servletRequest);
mgr.onStart(session, wsc);
