I have nothing in web.xml, but shiro still bootstraps itself and protects resources defined in shiro.ini. Is this expected behavior?

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

I have nothing in web.xml, but shiro still bootstraps itself and protects resources defined in shiro.ini. Is this expected behavior?

mbaron
I have nothing in web.xml, but shiro still bootstraps itself and protects
resources defined in shiro.ini.  Is this expected behavior?

If I add elements to web.xml along the lines of what is described here
https://shiro.apache.org/web.html, I see no difference in how my web
application is secured.

This holds true on tomcat 9.0.30 and Google Cloud Platform App Engine.



--
Sent from: http://shiro-user.582556.n2.nabble.com/
Reply | Threaded
Open this post in threaded view
|

Re: I have nothing in web.xml, but shiro still bootstraps itself and protects resources defined in shiro.ini. Is this expected behavior?

Brian Demers
Yup, this is expected if you are using the `shiro-servlet-plugin`, This module contains a web.xml fragment that is loaded automatically from your classpath.
If you need more control you can use the `shiro-web` module directly and configure your web.xml (or equivalent) configuration.


Does that help?

On Tue, Sep 15, 2020 at 12:03 AM mbaron <[hidden email]> wrote:
I have nothing in web.xml, but shiro still bootstraps itself and protects
resources defined in shiro.ini.  Is this expected behavior?

If I add elements to web.xml along the lines of what is described here
https://shiro.apache.org/web.html, I see no difference in how my web
application is secured.

This holds true on tomcat 9.0.30 and Google Cloud Platform App Engine.



--
Sent from: http://shiro-user.582556.n2.nabble.com/
Reply | Threaded
Open this post in threaded view
|

Re: I have nothing in web.xml, but shiro still bootstraps itself and protects resources defined in shiro.ini. Is this expected behavior?

mbaron
I do have have "shiro-servlet-plugin" in my Maven dependencies, so this makes
sense.  Thanks for the clarification.

P.S. Recently I was looking for a Java security framework and stumbled upon
Shiro.  I think it's brilliant.  It's so easy to setup and to use.  Does
everything I want without getting in the way or being overly complicated.
Kudos to those who created and maintain this project.



--
Sent from: http://shiro-user.582556.n2.nabble.com/
Reply | Threaded
Open this post in threaded view
|

Re: I have nothing in web.xml, but shiro still bootstraps itself and protects resources defined in shiro.ini. Is this expected behavior?

Brian Demers
Thanks!

On Tue, Sep 15, 2020 at 3:26 PM mbaron <[hidden email]> wrote:
I do have have "shiro-servlet-plugin" in my Maven dependencies, so this makes
sense.  Thanks for the clarification.

P.S. Recently I was looking for a Java security framework and stumbled upon
Shiro.  I think it's brilliant.  It's so easy to setup and to use.  Does
everything I want without getting in the way or being overly complicated.
Kudos to those who created and maintain this project.



--
Sent from: http://shiro-user.582556.n2.nabble.com/
Reply | Threaded
Open this post in threaded view
|

Re: I have nothing in web.xml, but shiro still bootstraps itself and protects resources defined in shiro.ini. Is this expected behavior?

fpapon
In reply to this post by mbaron
Happy to hear :)

regards,

François
[hidden email]

Le 15/09/2020 à 21:26, mbaron a écrit :

> I do have have "shiro-servlet-plugin" in my Maven dependencies, so this makes
> sense.  Thanks for the clarification.
>
> P.S. Recently I was looking for a Java security framework and stumbled upon
> Shiro.  I think it's brilliant.  It's so easy to setup and to use.  Does
> everything I want without getting in the way or being overly complicated.
> Kudos to those who created and maintain this project.
>
>
>
> --
> Sent from: http://shiro-user.582556.n2.nabble.com/