This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new dcb7b04bd jakarta-ee(form-data-save): updated docs with new in-process
mechanism and resubmit-without-login functionality (#326)
dcb7b04bd is described below
commit dcb7b04bd92b186422e87fb2ff82d498a380a042
Author: Lenny Primak <[email protected]>
AuthorDate: Mon Oct 26 20:05:07 2026 -0400
jakarta-ee(form-data-save): updated docs with new in-process mechanism and
resubmit-without-login functionality (#326)
---
.../blog/2024/02/apache-shiro-200-released.adoc | 2 +-
src/site/content/jakarta-ee.adoc | 28 ++++++++++++++++++++++
2 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/src/site/content/blog/2024/02/apache-shiro-200-released.adoc
b/src/site/content/blog/2024/02/apache-shiro-200-released.adoc
index 144f6da61..f9a32105c 100644
--- a/src/site/content/blog/2024/02/apache-shiro-200-released.adoc
+++ b/src/site/content/blog/2024/02/apache-shiro-200-released.adoc
@@ -37,7 +37,7 @@ This release is available for download now.
* Jakarta EE 10 support (Java/Jakarta EE 8 is also supported)
* New Jakarta EE integration module (see
https://shiro.apache.org/jakarta-ee.html[Jakarta EE Integration] for more
information)
* SpringBoot 3.x support (SpringBoot 2.x is also supported)
-* Automatic form resubmission when session expired (Jakarta EE only)
+* Saving form data to prevent data loss when session expires (Jakarta EE only)
== All changes
diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc
index c24ed91ea..7ee6b2367 100644
--- a/src/site/content/jakarta-ee.adoc
+++ b/src/site/content/jakarta-ee.adoc
@@ -328,6 +328,26 @@ To disable the no-login recovery for visitors who are not
signed in while keepin
<param-value>true</param-value>
</context-param>
----
+If the page doesn't require login, and the user is remembered or anonymous,
the form is submitted right away without any login or "session expired" page.
This does not apply to client-side Faces state saving, where the view state is
not lost with the session.
+
+[source,xml]
+.To limit this to remembered users only, add the following to `web.xml`:
+----
+<context-param>
+ <param-name>org.apache.shiro.form-resubmit.anonymous.disabled</param-name>
+ <param-value>true</param-value>
+</context-param>
+----
+
+[source,xml]
+.To re-render only the form's own render targets instead, add the following to
`web.xml`:
+----
+<context-param>
+
<param-name>org.apache.shiro.form-resubmit.ajax-render-all.disabled</param-name>
+ <param-value>true</param-value>
+</context-param>
+----
+Components outside those targets, and other forms on the page, may then keep
their pre-expiry state.
If a saved submission cannot be completed after login, Shiro returns the user
to the original page.
NOTE: If your application uses custom servlet filters that must also run when
Shiro replays a saved form, map them to `FORWARD` as well as `REQUEST`.
@@ -344,6 +364,14 @@ Form-resubmission cookies are secure by default.
----
Alternatively, you can set `org.apache.shiro.form-resubmit.secure-cookies`
system property in the same manner as above.
+To tell users that their form data was saved, and let them discard it (useful
on shared browsers), add the following inside the login form:
+[source,xml]
+----
+xmlns:shiro="http://shiro.apache.org/tags";
+...
+<shiro:formDataNotice/>
+----
+The `message` and `discardLabel` attributes override the default wording.
The `org.apache.shiro.form-resubmit-host` and
`org.apache.shiro.form-resubmit-port` system properties used by older releases
are no longer needed or used.
==== Configuring for Tomcat / Jetty (or without Jakarta Faces)
