This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro-site.git
commit 259640c6315a52739ee8cbb642fdbccaab824a61 Author: lprimak <[email protected]> AuthorDate: Sat May 2 23:54:22 2026 -0500 enh: reverted secureInDev flag and sync'd with current system proeprties --- src/site/content/jakarta-ee.adoc | 4 ++-- src/site/content/troubleshooting.adoc | 12 +++--------- 2 files changed, 5 insertions(+), 11 deletions(-) diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc index aa93297a1..38b360131 100644 --- a/src/site/content/jakarta-ee.adoc +++ b/src/site/content/jakarta-ee.adoc @@ -183,10 +183,10 @@ RememberMe functionality is disabled by default. You can enable it easily by add ---- authc.useRemembered = true ---- -RememberMe uses secure cookies by default. If you are running in non-HTTPS environment, you can disable secure cookies in Jakarta Faces' development mode only by adding the following to `shiro.ini` (this is the recommended configuration, but make sure production is running in Faces production mode): +RememberMe uses secure cookies by default. If you are running in non-HTTPS environment, you can disable secure cookies by adding the following to `shiro.ini` (this is not a recommended configuration, since it can lead to security vulnerabilities, but it is available for testing and development purposes): [source,properties] ---- -securityManager.rememberMeManager.secureInDevMode = false +securityManager.rememberMeManager.cookie.secure = false ---- [#rate_limiting] diff --git a/src/site/content/troubleshooting.adoc b/src/site/content/troubleshooting.adoc index e9fd5a053..0302dd86a 100644 --- a/src/site/content/troubleshooting.adoc +++ b/src/site/content/troubleshooting.adoc @@ -288,22 +288,16 @@ subject.isRemembered(); ---- 4. **Browser cookie issues**: Ensure the browser accepts cookies and that there are no domain/path mismatches. -By default, Shiro's Remember Me cookie is HTTP-only and secure. If you're testing in a non-HTTPS environment, you may need to adjust the secure flag for testing purposes. -You can use system property to control this behavior. Set `org.apache.shiro.rememberMe.secure.disabled` to `true` to disable the secure flag on the Remember Me cookie for testing. +By default, Session and Shiro's Remember Me cookie is HTTP-only and secure. If you're testing in a non-HTTPS environment, you may need to adjust the secure flag for testing purposes. +You can use system property to control this behavior. Set `org.apache.shiro.cookie.secure.disabled` to `true` to disable the secure flag on the session and Remember Me cookies for testing. You can also configure this in your `shiro.ini`: + [source,ini] ---- [main] +securityManager.sessionManager.sessionIdCookie.secure = false securityManager.rememberMeManager.cookie.secure = false ---- -For Jakarta EE applications, the secure flag is enabled by default. You can disable it for testing purposes in Jakarta Faces' Development mode only by setting the following in your shiro.ini: -+ -[source,ini] ----- -[main] -securityManager.rememberMeManager.secureInDevMode = false ----- === How do I generate a cipher key for Remember Me?
