diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 000000000..b5f2b9972 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,48 @@ +# Builds shiro-core and shiro-web jars and attaches them to a GitHub release +# on push of a v*-alauda tag. +name: Release Alauda-fork jars + +on: + workflow_dispatch: {} + push: + tags: + - 'v*-alauda' + +permissions: + contents: write + +jobs: + build-and-release: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up JDK 8 + uses: actions/setup-java@v3 + with: + java-version: 8 + distribution: temurin + + - name: Build shiro-core and shiro-web (skip tests, skip rat) + run: | + mvn -B -ntp -pl core,web -am \ + -DskipTests -Drat.skip=true \ + -Dinvoker.skip=true \ + package + + - name: Collect release artifacts + id: collect + run: | + mkdir -p release-artifacts + cp core/target/shiro-core-*.jar release-artifacts/ + cp web/target/shiro-web-*.jar release-artifacts/ + ls -l release-artifacts/ + + - name: Create GitHub Release + if: startsWith(github.ref, 'refs/tags/') + uses: softprops/action-gh-release@v2 + with: + files: release-artifacts/*.jar + generate_release_notes: true + fail_on_unmatched_files: true diff --git a/all/pom.xml b/all/pom.xml index 95126f5f1..11d162f5c 100644 --- a/all/pom.xml +++ b/all/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/bom/pom.xml b/bom/pom.xml index 9683af196..b04ed8ba4 100644 --- a/bom/pom.xml +++ b/bom/pom.xml @@ -21,7 +21,7 @@ shiro-root org.apache.shiro - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/cache/pom.xml b/cache/pom.xml index 14de6aede..d77efe78d 100644 --- a/cache/pom.xml +++ b/cache/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/config/core/pom.xml b/config/core/pom.xml index 53f87edec..f0f949548 100644 --- a/config/core/pom.xml +++ b/config/core/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-config - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/config/ogdl/pom.xml b/config/ogdl/pom.xml index 025a82f22..1c969efe8 100644 --- a/config/ogdl/pom.xml +++ b/config/ogdl/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-config - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/config/pom.xml b/config/pom.xml index c20bd7e77..9cfd9e714 100644 --- a/config/pom.xml +++ b/config/pom.xml @@ -24,7 +24,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda shiro-config diff --git a/core/pom.xml b/core/pom.xml index 005b7ca16..63a5ad7d1 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java index 235c8771b..f3fc3c14d 100644 --- a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java @@ -285,6 +285,11 @@ public Subject login(Subject subject, AuthenticationToken token) throws Authenti throw ae; //propagate } + Session existingSession = subject.getSession(false); + if (existingSession != null) { + existingSession.stop(); + } + Subject loggedIn = createSubject(token, info, subject); onSuccessfulLogin(token, info, loggedIn); diff --git a/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java b/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java index 3dc459cb3..1a58c2941 100644 --- a/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java @@ -39,6 +39,7 @@ import javax.naming.directory.SearchControls; import javax.naming.directory.SearchResult; import javax.naming.ldap.LdapContext; +import javax.naming.ldap.Rdn; import java.util.*; @@ -162,7 +163,7 @@ protected Set getRoleNamesForUser(String username, LdapContext ldapConte SearchControls searchCtls = new SearchControls(); searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE); - String userPrincipalName = username; + String userPrincipalName = Rdn.escapeValue(username); if (principalSuffix != null && !userPrincipalName.toLowerCase(Locale.ROOT).endsWith(principalSuffix.toLowerCase(Locale.ROOT))) { userPrincipalName += principalSuffix; } diff --git a/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java b/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java index dec43a94d..62ae56f10 100644 --- a/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java @@ -35,6 +35,7 @@ import javax.naming.AuthenticationNotSupportedException; import javax.naming.NamingException; import javax.naming.ldap.LdapContext; +import javax.naming.ldap.Rdn; /** * An LDAP {@link org.apache.shiro.realm.Realm Realm} implementation utilizing Sun's/Oracle's @@ -239,11 +240,12 @@ protected String getUserDn(String principal) throws IllegalArgumentException, Il int prefixLength = prefix != null ? prefix.length() : 0; int suffixLength = suffix != null ? suffix.length() : 0; - StringBuilder sb = new StringBuilder(prefixLength + principal.length() + suffixLength); + String sanitizedPrincipal = Rdn.escapeValue(principal); + StringBuilder sb = new StringBuilder(prefixLength + sanitizedPrincipal.length() + suffixLength); if (prefixLength > 0) { sb.append(prefix); } - sb.append(principal); + sb.append(sanitizedPrincipal); if (suffixLength > 0) { sb.append(suffix); } diff --git a/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java b/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java index da6930c70..8c8ac28c0 100644 --- a/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java +++ b/core/src/main/java/org/apache/shiro/session/mgt/DefaultSessionManager.java @@ -40,6 +40,8 @@ */ public class DefaultSessionManager extends AbstractValidatingSessionManager implements CacheManagerAware { + public static final String SECURE_COOKIE_DISABLED = "org.apache.shiro.cookie.secure.disabled"; + //TODO - complete JavaDoc private static final Logger log = LoggerFactory.getLogger(DefaultSessionManager.class); diff --git a/crypto/cipher/pom.xml b/crypto/cipher/pom.xml index 88e15c979..1501a312c 100644 --- a/crypto/cipher/pom.xml +++ b/crypto/cipher/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-crypto - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/crypto/core/pom.xml b/crypto/core/pom.xml index 493a8fe77..ab257fbf9 100644 --- a/crypto/core/pom.xml +++ b/crypto/core/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-crypto - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/crypto/hash/pom.xml b/crypto/hash/pom.xml index 698e59890..021a109f4 100644 --- a/crypto/hash/pom.xml +++ b/crypto/hash/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-crypto - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/crypto/pom.xml b/crypto/pom.xml index d6f23cf1b..fb7a3d158 100644 --- a/crypto/pom.xml +++ b/crypto/pom.xml @@ -24,7 +24,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda shiro-crypto diff --git a/event/pom.xml b/event/pom.xml index 4f8d84363..800e30ed0 100644 --- a/event/pom.xml +++ b/event/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/integration-tests/guice3/pom.xml b/integration-tests/guice3/pom.xml index 7570e71b9..eef5534ee 100644 --- a/integration-tests/guice3/pom.xml +++ b/integration-tests/guice3/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.integrationtests shiro-integration-tests - 1.13.1-alauda + 1.13.2-alauda shiro-its-guice3 diff --git a/integration-tests/guice4/pom.xml b/integration-tests/guice4/pom.xml index 53067fb7d..e0885421b 100644 --- a/integration-tests/guice4/pom.xml +++ b/integration-tests/guice4/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.integrationtests shiro-integration-tests - 1.13.1-alauda + 1.13.2-alauda shiro-its-guice4 diff --git a/integration-tests/pom.xml b/integration-tests/pom.xml index e4288ef86..00a425d1d 100644 --- a/integration-tests/pom.xml +++ b/integration-tests/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda org.apache.shiro.integrationtests diff --git a/integration-tests/support/pom.xml b/integration-tests/support/pom.xml index cda582fe4..4e8df104f 100644 --- a/integration-tests/support/pom.xml +++ b/integration-tests/support/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.integrationtests shiro-integration-tests - 1.13.1-alauda + 1.13.2-alauda shiro-its-support diff --git a/lang/pom.xml b/lang/pom.xml index 91eaf6330..9e9107bd0 100644 --- a/lang/pom.xml +++ b/lang/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/pom.xml b/pom.xml index 49d6ffc10..541574e06 100644 --- a/pom.xml +++ b/pom.xml @@ -30,7 +30,7 @@ org.apache.shiro shiro-root pom - 1.13.1-alauda + 1.13.2-alauda Apache Shiro https://shiro.apache.org/ diff --git a/samples/aspectj/pom.xml b/samples/aspectj/pom.xml index ac7f80c17..dec10e3d1 100644 --- a/samples/aspectj/pom.xml +++ b/samples/aspectj/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/guice/pom.xml b/samples/guice/pom.xml index 7cada9c85..52ca6d509 100644 --- a/samples/guice/pom.xml +++ b/samples/guice/pom.xml @@ -21,7 +21,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/jaxrs/pom.xml b/samples/jaxrs/pom.xml index a09990075..a47c3c2a2 100644 --- a/samples/jaxrs/pom.xml +++ b/samples/jaxrs/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/pom.xml b/samples/pom.xml index 153f30698..294182d8e 100644 --- a/samples/pom.xml +++ b/samples/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/quickstart-guice/pom.xml b/samples/quickstart-guice/pom.xml index 1e5bbf00d..319f88191 100644 --- a/samples/quickstart-guice/pom.xml +++ b/samples/quickstart-guice/pom.xml @@ -21,7 +21,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/quickstart/pom.xml b/samples/quickstart/pom.xml index 3b3a30a09..e70078aae 100644 --- a/samples/quickstart/pom.xml +++ b/samples/quickstart/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/servlet-plugin/pom.xml b/samples/servlet-plugin/pom.xml index f1a0665cf..156eb38a2 100644 --- a/samples/servlet-plugin/pom.xml +++ b/samples/servlet-plugin/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/spring-boot-web/pom.xml b/samples/spring-boot-web/pom.xml index 3fec2d1d4..70d980a22 100644 --- a/samples/spring-boot-web/pom.xml +++ b/samples/spring-boot-web/pom.xml @@ -25,7 +25,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda samples-spring-boot-web diff --git a/samples/spring-boot/pom.xml b/samples/spring-boot/pom.xml index 92b59fda6..0f760a1ef 100644 --- a/samples/spring-boot/pom.xml +++ b/samples/spring-boot/pom.xml @@ -25,7 +25,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda samples-spring-boot diff --git a/samples/spring-hibernate/pom.xml b/samples/spring-hibernate/pom.xml index 82bc7ef99..8a628832e 100644 --- a/samples/spring-hibernate/pom.xml +++ b/samples/spring-hibernate/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/spring-mvc/pom.xml b/samples/spring-mvc/pom.xml index 826e5e423..f0c22ec7a 100644 --- a/samples/spring-mvc/pom.xml +++ b/samples/spring-mvc/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/spring/pom.xml b/samples/spring/pom.xml index efbe70d61..aae0d9c60 100644 --- a/samples/spring/pom.xml +++ b/samples/spring/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/web-jakarta/pom.xml b/samples/web-jakarta/pom.xml index cb0087d82..8054dd945 100644 --- a/samples/web-jakarta/pom.xml +++ b/samples/web-jakarta/pom.xml @@ -21,7 +21,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/samples/web/pom.xml b/samples/web/pom.xml index 2e1147c7a..a67d4b578 100644 --- a/samples/web/pom.xml +++ b/samples/web/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro.samples shiro-samples - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/aspectj/pom.xml b/support/aspectj/pom.xml index 1b9e0a5eb..f1663be09 100644 --- a/support/aspectj/pom.xml +++ b/support/aspectj/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/cas/pom.xml b/support/cas/pom.xml index 32b4ce76b..b62860818 100644 --- a/support/cas/pom.xml +++ b/support/cas/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/ehcache/pom.xml b/support/ehcache/pom.xml index 275c5b9a2..77f818ee5 100644 --- a/support/ehcache/pom.xml +++ b/support/ehcache/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/features/pom.xml b/support/features/pom.xml index 1cd349795..20218fd2c 100644 --- a/support/features/pom.xml +++ b/support/features/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/guice/pom.xml b/support/guice/pom.xml index 2727be838..b047c7bd5 100644 --- a/support/guice/pom.xml +++ b/support/guice/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/hazelcast/pom.xml b/support/hazelcast/pom.xml index aa87cd252..99068fc2c 100644 --- a/support/hazelcast/pom.xml +++ b/support/hazelcast/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/jaxrs/pom.xml b/support/jaxrs/pom.xml index ae338a4d6..df66dd50b 100644 --- a/support/jaxrs/pom.xml +++ b/support/jaxrs/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/jcache/pom.xml b/support/jcache/pom.xml index e3d0d6dd9..1f1124d53 100644 --- a/support/jcache/pom.xml +++ b/support/jcache/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda ../pom.xml diff --git a/support/pom.xml b/support/pom.xml index 67fa5b2cf..9b2361691 100644 --- a/support/pom.xml +++ b/support/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/quartz/pom.xml b/support/quartz/pom.xml index 48c84b925..181d631f2 100644 --- a/support/quartz/pom.xml +++ b/support/quartz/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/servlet-plugin/pom.xml b/support/servlet-plugin/pom.xml index dfc548eb8..e0245d025 100644 --- a/support/servlet-plugin/pom.xml +++ b/support/servlet-plugin/pom.xml @@ -25,7 +25,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda shiro-servlet-plugin diff --git a/support/spring-boot/pom.xml b/support/spring-boot/pom.xml index b1b23bd7a..ea5bb55f7 100644 --- a/support/spring-boot/pom.xml +++ b/support/spring-boot/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/support/spring-boot/spring-boot-starter/pom.xml b/support/spring-boot/spring-boot-starter/pom.xml index 1802f6248..1917d2e5f 100644 --- a/support/spring-boot/spring-boot-starter/pom.xml +++ b/support/spring-boot/spring-boot-starter/pom.xml @@ -25,7 +25,7 @@ org.apache.shiro shiro-spring-boot - 1.13.1-alauda + 1.13.2-alauda shiro-spring-boot-starter diff --git a/support/spring-boot/spring-boot-web-starter/pom.xml b/support/spring-boot/spring-boot-web-starter/pom.xml index dd8093c5e..3eb4878fe 100644 --- a/support/spring-boot/spring-boot-web-starter/pom.xml +++ b/support/spring-boot/spring-boot-web-starter/pom.xml @@ -25,7 +25,7 @@ org.apache.shiro shiro-spring-boot - 1.13.1-alauda + 1.13.2-alauda shiro-spring-boot-web-starter diff --git a/support/spring/pom.xml b/support/spring/pom.xml index 742b6b1db..da4f5cc2a 100644 --- a/support/spring/pom.xml +++ b/support/spring/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-support - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/test-coverage/pom.xml b/test-coverage/pom.xml index 879f922fc..55a89f9ff 100644 --- a/test-coverage/pom.xml +++ b/test-coverage/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/tools/hasher/pom.xml b/tools/hasher/pom.xml index b00c3e423..171746d9c 100644 --- a/tools/hasher/pom.xml +++ b/tools/hasher/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro.tools shiro-tools - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/tools/pom.xml b/tools/pom.xml index 1bca85b8e..0e18afe4e 100644 --- a/tools/pom.xml +++ b/tools/pom.xml @@ -22,7 +22,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/web/pom.xml b/web/pom.xml index 63764e09d..e4b70c004 100644 --- a/web/pom.xml +++ b/web/pom.xml @@ -23,7 +23,7 @@ org.apache.shiro shiro-root - 1.13.1-alauda + 1.13.2-alauda 4.0.0 diff --git a/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java b/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java index 798bf4010..f2076e35f 100644 --- a/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java +++ b/web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java @@ -35,6 +35,8 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import static org.apache.shiro.session.mgt.DefaultSessionManager.SECURE_COOKIE_DISABLED; + /** * Remembers a Subject's identity by saving the Subject's {@link Subject#getPrincipals() principals} to a {@link Cookie} @@ -87,6 +89,9 @@ public class CookieRememberMeManager extends AbstractRememberMeManager { public CookieRememberMeManager() { Cookie cookie = new SimpleCookie(DEFAULT_REMEMBER_ME_COOKIE_NAME); cookie.setHttpOnly(true); + if (!Boolean.getBoolean(SECURE_COOKIE_DISABLED)) { + cookie.setSecure(true); + } //One year should be long enough - most sites won't object to requiring a user to log in if they haven't visited //in a year: cookie.setMaxAge(Cookie.ONE_YEAR); diff --git a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java index a4a8409e9..ece07ab18 100644 --- a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java +++ b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java @@ -247,7 +247,7 @@ public void saveTo(HttpServletRequest request, HttpServletResponse response) { String path = calculatePath(request); int maxAge = getMaxAge(); int version = getVersion(); - boolean secure = isSecure(); + boolean secure = isSecure() && request.isSecure(); boolean httpOnly = isHttpOnly(); SameSiteOptions sameSite = getSameSite(); diff --git a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java index 4fd6a4ef8..bad002679 100644 --- a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java +++ b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java @@ -56,6 +56,9 @@ public class DefaultWebSessionManager extends DefaultSessionManager implements W public DefaultWebSessionManager() { Cookie cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME); cookie.setHttpOnly(true); //more secure, protects against XSS attacks + if (!Boolean.getBoolean(SECURE_COOKIE_DISABLED)) { + cookie.setSecure(true); + } this.sessionIdCookie = cookie; this.sessionIdCookieEnabled = true; this.sessionIdUrlRewritingEnabled = false;