or run

npx @tessl/cli init

Version

Tile

Overview

Evals

Files

docs

index.md

tile.json

tessl/maven-org-apache-shiro--shiro-spring-boot-web-starter

Spring Boot starter providing auto-configuration for Apache Shiro security framework in web applications

Workspace: tessl
Visibility: Public
Created: 3 months ago
Last updated: 3 months ago
Describes: pkg:maven/org.apache.shiro/shiro-spring-boot-web-starter@2.0.x

To install, run

npx @tessl/cli install tessl/maven-org-apache-shiro--shiro-spring-boot-web-starter@2.0.0

Apache Shiro Spring Boot Web Starter

Apache Shiro Spring Boot Web Starter provides seamless auto-configuration integration for Apache Shiro security framework in Spring Boot web applications. This starter extends the base shiro-spring-boot-starter by adding web-specific dependencies and configurations, enabling authentication, authorization, cryptography, and session management with minimal manual setup.

Package Information

Package Name: shiro-spring-boot-web-starter
Group ID: org.apache.shiro
Language: Java
Package Type: Maven Spring Boot Starter
Installation: Add dependency to pom.xml or build.gradle

Maven Dependency

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring-boot-web-starter</artifactId>
    <version>2.0.5</version>
</dependency>

Gradle Dependency

implementation 'org.apache.shiro:shiro-spring-boot-web-starter:2.0.5'

Core Imports

// Basic Spring Boot application setup
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

// For custom realm configuration
import org.apache.shiro.realm.Realm;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

// For filter chain configuration
import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;

// For security annotations
import org.apache.shiro.authz.annotation.RequiresAuthentication;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.authz.annotation.RequiresPermissions;

// For environment processing (internal use)
import org.springframework.boot.env.EnvironmentPostProcessor;
import org.springframework.core.env.ConfigurableEnvironment;

Basic Usage

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class MyWebApplication {
    public static void main(String[] args) {
        SpringApplication.run(MyWebApplication.class, args);
    }
    
    // Shiro auto-configuration will automatically configure security components
    // No additional configuration required for basic setup
}

Configuration with Custom Realm

import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroConfig {
    
    @Bean
    public Realm myRealm() {
        // Custom realm implementation
        return new MyCustomRealm();
    }
    
    @Bean
    public ShiroFilterChainDefinition shiroFilterChainDefinition() {
        DefaultShiroFilterChainDefinition chainDefinition = 
            new DefaultShiroFilterChainDefinition();
        
        chainDefinition.addPathDefinition("/login", "anon");
        chainDefinition.addPathDefinition("/admin/**", "authc, roles[admin]");
        chainDefinition.addPathDefinition("/**", "authc");
        
        return chainDefinition;
    }
}

Configuration Properties

Configure Shiro through application.properties or application.yml:

# Core Shiro configuration
shiro.enabled=true
shiro.web.enabled=true
shiro.annotations.enabled=true

# URL configuration
shiro.loginUrl=/login.jsp
shiro.successUrl=/
shiro.unauthorizedUrl=/unauthorized

# Session management
shiro.sessionManager.sessionIdCookieEnabled=true
shiro.sessionManager.sessionIdUrlRewritingEnabled=false
shiro.sessionManager.deleteInvalidSessions=true
shiro.userNativeSessionManager=false

# Session cookie configuration
shiro.sessionManager.cookie.name=JSESSIONID
shiro.sessionManager.cookie.maxAge=-1
shiro.sessionManager.cookie.domain=
shiro.sessionManager.cookie.path=
shiro.sessionManager.cookie.secure=false
shiro.sessionManager.cookie.sameSite=LAX

# Remember me cookie configuration
shiro.rememberMeManager.cookie.name=rememberMe
shiro.rememberMeManager.cookie.maxAge=31536000
shiro.rememberMeManager.cookie.domain=
shiro.rememberMeManager.cookie.path=
shiro.rememberMeManager.cookie.secure=false
shiro.rememberMeManager.cookie.sameSite=LAX

Capabilities

Auto-Configuration Beans

The starter automatically configures essential Shiro components as Spring beans when they are not already defined.

// Core security components
@Bean AuthenticationStrategy authenticationStrategy()
@Bean Authenticator authenticator()
@Bean Authorizer authorizer()
@Bean SessionsSecurityManager securityManager(List<Realm> realms)

// Subject and session management
@Bean SubjectDAO subjectDAO()
@Bean SessionStorageEvaluator sessionStorageEvaluator()
@Bean SubjectFactory subjectFactory()
@Bean SessionFactory sessionFactory()
@Bean SessionDAO sessionDAO()
@Bean SessionManager sessionManager()

// Web-specific components
@Bean Cookie sessionCookieTemplate()
@Bean RememberMeManager rememberMeManager()
@Bean Cookie rememberMeCookieTemplate()
@Bean ShiroFilterChainDefinition shiroFilterChainDefinition()
@Bean ShiroUrlPathHelper shiroUrlPathHelper()

// Filter configuration
@Bean ShiroFilterFactoryBean shiroFilterFactoryBean()
@Bean FilterRegistrationBean<AbstractShiroFilter> filterShiroFilterRegistrationBean()
@Bean List<String> globalFilters()

// Bean lifecycle management
@Bean LifecycleBeanPostProcessor lifecycleBeanPostProcessor()
@Bean EventBus eventBus()
@Bean ShiroEventBusBeanPostProcessor shiroEventBusAwareBeanPostProcessor()

// Annotation processing
@Bean DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator()
@Bean AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager)

// Spring MVC integration (when RequestMappingHandlerMapping is available)
// Imports ShiroRequestMappingConfig for Spring MVC integration

// Environment processing
// ShiroEnvironmentPostProcessor automatically configures ant path matcher strategy

Realm Auto-Discovery

Automatically configures realms from common locations:

// Conditional realm beans - configured if resource exists
@Bean Realm iniClasspathRealm()  // when classpath:shiro.ini exists
@Bean Realm iniMetaInfClasspathRealm()  // when classpath:META-INF/shiro.ini exists

// Exception handling
@Bean Realm missingRealm()  // throws NoRealmBeanConfiguredException if no realm configured

Configuration Properties API

Properties available for Spring Boot configuration:

// Core enable/disable flags
Boolean shiro.enabled = true;  // Global enable/disable flag
Boolean shiro.web.enabled = true;  // Web-specific features
Boolean shiro.annotations.enabled = true;  // Annotation processing

// URL configuration
String shiro.loginUrl = "/login.jsp";  // Login page URL
String shiro.successUrl = "/";  // Post-login success URL
String shiro.unauthorizedUrl = null;  // Unauthorized access URL

// Session management
Boolean shiro.sessionManager.sessionIdCookieEnabled = true;  // Session cookies enabled
Boolean shiro.sessionManager.sessionIdUrlRewritingEnabled = false;  // URL rewriting for session tracking
Boolean shiro.sessionManager.deleteInvalidSessions = true;  // Delete invalid sessions
Boolean shiro.userNativeSessionManager = false;  // Use native session manager vs servlet container

// Session cookie configuration
String shiro.sessionManager.cookie.name = "JSESSIONID";  // Session cookie name
Integer shiro.sessionManager.cookie.maxAge = -1;  // Session cookie max age (default: session)
String shiro.sessionManager.cookie.domain = null;  // Session cookie domain
String shiro.sessionManager.cookie.path = null;  // Session cookie path
Boolean shiro.sessionManager.cookie.secure = false;  // Session cookie secure flag
String shiro.sessionManager.cookie.sameSite = "LAX";  // Session cookie SameSite policy

// Remember me cookie configuration
String shiro.rememberMeManager.cookie.name = "rememberMe";  // Remember me cookie name
Integer shiro.rememberMeManager.cookie.maxAge = 31536000;  // Remember me max age (1 year)
String shiro.rememberMeManager.cookie.domain = null;  // Remember me cookie domain
String shiro.rememberMeManager.cookie.path = null;  // Remember me cookie path
Boolean shiro.rememberMeManager.cookie.secure = false;  // Remember me cookie secure flag
String shiro.rememberMeManager.cookie.sameSite = "LAX";  // Remember me cookie SameSite policy

Filter Constants

Constants for filter registration and naming:

// ShiroWebFilterConfiguration constants
String REGISTRATION_BEAN_NAME = "filterShiroFilterRegistrationBean";
String FILTER_NAME = "shiroFilter";

Exception Types

Exception classes that may be thrown during configuration:

// Thrown when no realm is configured
class NoRealmBeanConfiguredException extends RuntimeException {
    // Constructor and methods inherited from RuntimeException
}

Types

// Core Shiro interfaces and classes available through auto-configuration
interface Realm {
    // Authentication and authorization interface
}

interface AuthenticationStrategy {
    // Strategy for handling multiple realms
}

interface Authenticator {
    // Authentication processing interface
}

interface Authorizer {
    // Authorization processing interface
}

interface SessionManager {
    // Session lifecycle management
}

interface SessionDAO {
    // Session persistence interface
}

interface SubjectDAO {
    // Subject state persistence interface
}

interface SubjectFactory {
    // Subject instance creation interface
}

interface SessionFactory {
    // Session instance creation interface
}

interface SessionStorageEvaluator {
    // Session storage decision interface
}

interface RememberMeManager {
    // Remember me functionality interface
}

class Cookie {
    // Cookie configuration for sessions and remember me
}

interface ShiroFilterChainDefinition {
    // Filter chain URL pattern definitions
}

class ShiroUrlPathHelper {
    // URL path resolution utility
}

class ShiroFilterFactoryBean {
    // Factory for creating Shiro filter instances
}

class FilterRegistrationBean<T> {
    // Spring Boot filter registration
}

class LifecycleBeanPostProcessor {
    // Bean lifecycle management
}

class EventBus {
    // Event handling system
}

class ShiroEventBusBeanPostProcessor {
    // Event bus integration
}

class DefaultAdvisorAutoProxyCreator {
    // AOP proxy creation for annotations
}

class AuthorizationAttributeSourceAdvisor {
    // Security annotation processing
}

class ShiroEnvironmentPostProcessor implements EnvironmentPostProcessor {
    // Automatically configures Spring MVC path matching strategy to ant_path_matcher
    void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application);
}

Usage Examples

Basic Web Application Setup

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class SecureWebApp {
    public static void main(String[] args) {
        SpringApplication.run(SecureWebApp.class, args);
    }
}

// application.properties
// shiro.loginUrl=/login
// shiro.successUrl=/dashboard
// shiro.unauthorizedUrl=/unauthorized

Custom Realm Configuration

import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.stereotype.Component;

@Component
public class DatabaseRealm extends AuthorizingRealm {
    
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // Authorization logic
        return new SimpleAuthorizationInfo();
    }
    
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
        // Authentication logic
        return new SimpleAuthenticationInfo();
    }
}

Security Filter Chain Configuration

import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroWebConfig {
    
    @Bean
    public ShiroFilterChainDefinition shiroFilterChainDefinition() {
        DefaultShiroFilterChainDefinition definition = 
            new DefaultShiroFilterChainDefinition();
        
        // Public endpoints
        definition.addPathDefinition("/", "anon");
        definition.addPathDefinition("/login", "anon");
        definition.addPathDefinition("/css/**", "anon");
        definition.addPathDefinition("/js/**", "anon");
        
        // Protected endpoints
        definition.addPathDefinition("/admin/**", "authc, roles[admin]");
        definition.addPathDefinition("/user/**", "authc");
        definition.addPathDefinition("/**", "authc");
        
        return definition;
    }
}

Using Security Annotations

import org.apache.shiro.authz.annotation.RequiresAuthentication;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;
import java.util.List;

@RestController
public class SecureController {
    
    @RequiresAuthentication
    @GetMapping("/profile")
    public String getProfile() {
        return "User profile";
    }
    
    @RequiresRoles("admin")
    @GetMapping("/admin/users")
    public List<User> getUsers() {
        return userService.getAllUsers();
    }
    
    @RequiresPermissions("user:create")
    @PostMapping("/users")
    public User createUser(@RequestBody User user) {
        return userService.createUser(user);
    }
}

Cookie Configuration Example

import org.springframework.context.annotation.Configuration;
import org.springframework.boot.context.properties.ConfigurationProperties;

@Configuration
public class ShiroSecurityConfig {
    
    // Configure secure cookies for production
    // application.properties:
    /*
    shiro.sessionManager.cookie.secure=true
    shiro.sessionManager.cookie.sameSite=STRICT
    shiro.rememberMeManager.cookie.secure=true
    shiro.rememberMeManager.cookie.sameSite=STRICT
    shiro.rememberMeManager.cookie.maxAge=604800
    */
}

Environment-Specific Configuration

# Development environment (application-dev.properties)
shiro.sessionManager.cookie.secure=false
shiro.sessionManager.cookie.sameSite=LAX
shiro.rememberMeManager.cookie.secure=false

# Production environment (application-prod.properties)
shiro.sessionManager.cookie.secure=true
shiro.sessionManager.cookie.sameSite=STRICT
shiro.rememberMeManager.cookie.secure=true
shiro.sessionManager.cookie.domain=.yourdomain.com

Notes

This starter is a dependency aggregation module that pulls in the base shiro-spring-boot-starter and adds web-specific dependencies
All auto-configured beans are conditional and can be overridden by defining custom beans
The starter integrates seamlessly with Spring Boot's auto-configuration system
Supports both programmatic configuration and properties-based configuration
Automatically registers the Shiro filter in the Spring Boot servlet container
Enables Shiro security annotations through AOP integration
Compatible with Spring Boot 2.x and 3.x (check compatibility matrix for specific versions)