> It accesses the session from a filter which comes before the Shiro > filter in the chain. I guess that's what the problem is.
Yep, that would do it. > Unfortunately, I'm not sure I'll be able to fix that without changing > Grails itself. Do you have any idea whether the Shiro filter should > come after Spring's CharEncodingFilter? Or is it OK if it comes > before? It will be fine if it is before the CharEncodingFilter. The only requirement when using native sessions is that no filter before the ShiroFilter should use the HttpSession. For example, one thing you thing you might want before the ShiroFilter would be something that optimizes transactions in case the ShiroFilter needs to access a transactional resource when performing session creation or when performing authorization checks (e.g. an OpenSessionInViewFilter or similar construct). That way a transaction that is opened for Shiro's needs can stay open to the other filters and/or final handler in the chain for performance. For my Shiro/Spring/Hibernate applications, I always have the OpenSessionInViewFilter come before the ShiroFilter for this reason. Almost all other filters come after the ShiroFilter. HTH, Les
