Apache Shiro Web

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>1.13.0</version>
</dependency>

implementation 'org.apache.shiro:shiro-web:1.13.0'

// Primary servlet filter for web applications
import org.apache.shiro.web.servlet.ShiroFilter;

// Environment setup and configuration
import org.apache.shiro.web.env.EnvironmentLoaderListener;
import org.apache.shiro.web.env.WebEnvironment;

// Security manager for web applications
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.mgt.WebSecurityManager;

// Filter management and configuration
import org.apache.shiro.web.filter.mgt.FilterChainManager;
import org.apache.shiro.web.filter.mgt.DefaultFilterChainManager;

// Web subject for request/response access
import org.apache.shiro.web.subject.WebSubject;

// web.xml configuration
/*
<listener>
    <listener-class>
        org.apache.shiro.web.env.EnvironmentLoaderListener
    </listener-class>
</listener>

<filter>
    <filter-name>ShiroFilter</filter-name>
    <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>ShiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>INCLUDE</dispatcher>
    <dispatcher>ERROR</dispatcher>
</filter-mapping>
*/

// Programmatic filter configuration
import org.apache.shiro.web.servlet.AbstractShiroFilter;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.filter.mgt.DefaultFilterChainManager;

public class ShiroConfig {
    public AbstractShiroFilter createShiroFilter() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        
        AbstractShiroFilter shiroFilter = new AbstractShiroFilter() {};
        shiroFilter.setSecurityManager(securityManager);
        
        DefaultFilterChainManager filterChainManager = new DefaultFilterChainManager();
        filterChainManager.createChain("/login", "authc");
        filterChainManager.createChain("/admin/**", "authc, roles[admin]");
        filterChainManager.createChain("/user/**", "authc");
        filterChainManager.createChain("/**", "anon");
        
        return shiroFilter;
    }
}

import org.apache.shiro.web.subject.WebSubject;
import org.apache.shiro.web.util.WebUtils;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public void handleRequest(HttpServletRequest request, HttpServletResponse response) {
    WebSubject currentUser = (WebSubject) SecurityUtils.getSubject();
    
    // Access servlet request/response through WebSubject
    HttpServletRequest subjectRequest = currentUser.getServletRequest();
    HttpServletResponse subjectResponse = currentUser.getServletResponse();
    
    // Check authentication and authorization
    if (currentUser.isAuthenticated()) {
        if (currentUser.hasRole("admin")) {
            // Admin functionality
        }
    } else {
        // Redirect to login
        WebUtils.issueRedirect(request, response, "/login");
    }
}

// Primary environment interface
interface WebEnvironment extends Environment {
    FilterChainResolver getFilterChainResolver();
    ServletContext getServletContext();
    WebSecurityManager getWebSecurityManager();
}

// Environment initialization
class EnvironmentLoaderListener implements ServletContextListener {
    public void contextInitialized(ServletContextEvent event);
    public void contextDestroyed(ServletContextEvent event);
}

// Configuration factories
class IniFilterChainResolverFactory extends IniFactorySupport<FilterChainResolver> {
    public FilterChainResolver createInstance(Ini ini);
}

// Primary servlet filter
class ShiroFilter extends AbstractShiroFilter {
    public void init() throws ServletException;
}

// Base filter functionality
abstract class AbstractShiroFilter extends OncePerRequestFilter {
    public WebSecurityManager getSecurityManager();
    public void setSecurityManager(WebSecurityManager securityManager);
    public FilterChainResolver getFilterChainResolver();
    public void setFilterChainResolver(FilterChainResolver resolver);
}

// Filter templates
abstract class AccessControlFilter extends PathMatchingFilter {
    public String getLoginUrl();
    public void setLoginUrl(String loginUrl);
    protected abstract boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue);
    protected abstract boolean onAccessDenied(ServletRequest request, ServletResponse response);
}

// Form authentication
class FormAuthenticationFilter extends AuthenticatingFilter {
    public String getUsernameParam();
    public void setUsernameParam(String usernameParam);
    public String getPasswordParam();
    public void setPasswordParam(String passwordParam);
    public boolean isRememberMe(ServletRequest request);
}

// HTTP Basic authentication
class BasicHttpAuthenticationFilter extends HttpAuthenticationFilter {
    protected String[] getPrincipalsAndCredentials(String authorizationHeader, ServletRequest request);
}

// Logout handling
class LogoutFilter extends AdviceFilter {
    public String getRedirectUrl();
    public void setRedirectUrl(String redirectUrl);
}

// Permission-based authorization
class PermissionsAuthorizationFilter extends AuthorizationFilter {
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue);
}

// Role-based authorization
class RolesAuthorizationFilter extends AuthorizationFilter {
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue);
}

// SSL enforcement
class SslFilter extends PortFilter {
    public int getPort();
    public void setPort(int port);
}

// HTTP method permissions
class HttpMethodPermissionFilter extends PermissionsAuthorizationFilter {
    protected String getHttpMethodAction(ServletRequest request);
}

// Filter chain resolution
interface FilterChainResolver {
    FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain);
}

// Filter chain management
interface FilterChainManager {
    Map<String, NamedFilterList> getFilterChains();
    NamedFilterList getChain(String chainName);
    void createChain(String chainName, String chainDefinition);
    void addToChain(String chainName, String filterName);
}

// Default implementations
class PathMatchingFilterChainResolver implements FilterChainResolver;
class DefaultFilterChainManager implements FilterChainManager;

// Predefined filters
enum DefaultFilter {
    anon(AnonymousFilter.class),
    authc(FormAuthenticationFilter.class),
    authcBasic(BasicHttpAuthenticationFilter.class),
    authcBearer(BearerHttpAuthenticationFilter.class),
    logout(LogoutFilter.class),
    noSessionCreation(NoSessionCreationFilter.class),
    perms(PermissionsAuthorizationFilter.class),
    port(PortFilter.class),
    rest(HttpMethodPermissionFilter.class),
    roles(RolesAuthorizationFilter.class),
    ssl(SslFilter.class),
    user(UserFilter.class),
    invalidRequest(InvalidRequestFilter.class);
    
    public Filter newInstance();
    public Class<? extends Filter> getFilterClass();
    public static Map<String, Filter> createInstanceMap(FilterConfig config);
}

// Web security manager
interface WebSecurityManager extends SecurityManager {
    boolean isHttpSessionMode();
}

class DefaultWebSecurityManager extends DefaultSecurityManager implements WebSecurityManager {
    public DefaultWebSecurityManager();
    public DefaultWebSecurityManager(Realm singleRealm);
    public DefaultWebSecurityManager(Collection<Realm> realms);
}

// Cookie-based remember me
class CookieRememberMeManager extends AbstractRememberMeManager {
    public Cookie getCookie();
    public void setCookie(Cookie cookie);
    public String getCipherKey();
    public void setCipherKey(String cipherKey);
}

// Web subject factory
class DefaultWebSubjectFactory extends DefaultSubjectFactory {
    public Subject createSubject(SubjectContext context);
}

// Web session manager interface  
interface WebSessionManager extends SessionManager {
    boolean isServletContainerSessions();
}

// Default web session manager
class DefaultWebSessionManager extends DefaultSessionManager implements WebSessionManager {
    public boolean isServletContainerSessions();
    public Cookie getSessionIdCookie();
    public void setSessionIdCookie(Cookie cookie);
    public boolean isSessionIdUrlRewritingEnabled();
    public void setSessionIdUrlRewritingEnabled(boolean sessionIdUrlRewritingEnabled);
}

// Servlet container session delegation
class ServletContainerSessionManager implements WebSessionManager {
    public Session start(SessionContext context);
    public Session getSession(SessionKey key);
}

// Session contexts and keys
interface WebSessionContext extends SessionContext, RequestPairSource;
class DefaultWebSessionContext extends DefaultSessionContext implements WebSessionContext;
class WebSessionKey extends DefaultSessionKey implements RequestPairSource;

// Web subject interface
interface WebSubject extends Subject, RequestPairSource {
    ServletRequest getServletRequest(); 
    ServletResponse getServletResponse();
    
    // Builder for creating WebSubject instances
    class Builder extends Subject.Builder {
        public Builder(SecurityManager securityManager, ServletRequest request, ServletResponse response);
        public Builder sessionId(Serializable sessionId);
        public Builder host(String host);
        public Builder session(Session session);
        public WebSubject buildWebSubject();
    }
}

// Context for web subject creation
interface WebSubjectContext extends SubjectContext, RequestPairSource;
class DefaultWebSubjectContext extends DefaultSubjectContext implements WebSubjectContext;

// Web subject implementation
class WebDelegatingSubject extends DelegatingSubject implements WebSubject {
    public ServletRequest getServletRequest();
    public ServletResponse getServletResponse();
}

// Base tag class
abstract class SecureTag extends TagSupport {
    protected Subject getSubject();
    protected abstract int onDoStartTag() throws JspException;
}

// Authentication tags
class AuthenticatedTag extends SecureTag;    // Shows content if authenticated
class NotAuthenticatedTag extends SecureTag; // Shows content if not authenticated  
class UserTag extends SecureTag;             // Shows content if user known
class GuestTag extends SecureTag;            // Shows content if guest

// Authorization tags
class HasRoleTag extends RoleTag;            // Shows content if has role
class LacksRoleTag extends RoleTag;          // Shows content if lacks role
class HasAnyRolesTag extends RoleTag;        // Shows content if has any role
class HasPermissionTag extends PermissionTag; // Shows content if has permission
class LacksPermissionTag extends PermissionTag; // Shows content if lacks permission

// Utility tags
class PrincipalTag extends SecureTag;        // Displays principal

class WebUtils {
    // Path and context utilities
    public static String getPathWithinApplication(HttpServletRequest request);
    public static String getContextPath(HttpServletRequest request);
    
    // Environment access
    public static WebEnvironment getWebEnvironment(ServletContext servletContext);
    
    // Redirect utilities
    public static void issueRedirect(ServletRequest request, ServletResponse response, String url) throws IOException;
    public static void issueRedirect(ServletRequest request, ServletResponse response, String url, Map<String, ?> queryParams, boolean contextRelative, boolean http10Compatible) throws IOException;
    
    // Request saving and restoration
    public static void saveRequest(ServletRequest request);
    public static SavedRequest getSavedRequest(ServletRequest request);
    public static SavedRequest getAndClearSavedRequest(ServletRequest request);
    public static void redirectToSavedRequest(ServletRequest request, ServletResponse response, String fallbackUrl) throws IOException;
    
    // Type conversion utilities
    public static HttpServletRequest toHttp(ServletRequest request);
    public static HttpServletResponse toHttp(ServletResponse response);
}

// Saved request representation
class SavedRequest implements Serializable {
    public String getMethod();
    public String getQueryString(); 
    public String getRequestURI();
    public String getRequestURL();
    public Map<String, String[]> getParameterMap();
}