Fix broken login flow in shiro-basic example - #545
Merged
Conversation
The example was unusable: every request redirected to Shiro's default loginUrl of /login.jsp, which does not exist here, producing an infinite redirect loop. shiro.ini defined only [users] and [roles], so no filter chain was configured and Shiro protected every path including the login page and the form it posts to. Because shiroFilter is mapped for FORWARD as well as REQUEST, the JSPs the Struts actions forward to were caught too, so listing only the actions would not have been enough. Adds a [main] section pointing authc at the login action, and a [urls] chain leaving the login path anonymous while protecting the rest. Separately, the container rewrote redirect URLs as ...;jsessionid=... on a visitor's first request, and Jetty 11 rejects its own rewritten URI with HTTP 400 Invalid request. Restricting session tracking to cookies stops the rewriting. Verified in a browser and over HTTP: login as lonestarr renders the welcome page with roles and permissions resolved, logout returns to the login page, and welcome.action is no longer reachable afterwards. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the
shiro-basicexample usable again. It follows #536 (Shiro 3.0.0), which fixed the module's startup — this fixes the login flow that was broken underneath it.What was wrong
Two independent problems, both pre-existing:
1. Infinite redirect loop.
shiro.inidefined only[users]and[roles], with no filter chain, so Shiro protected every path — including the login page and the form it posts to. Unauthenticated visitors were redirected to Shiro's defaultloginUrlof/login.jsp, which does not exist in this webapp (the form is rendered by theloginStruts action). Every URL redirected to a page that redirected again; I measured 50 redirects without resolving.Worth noting for anyone fixing something similar:
shiroFilteris mapped forFORWARDas well asREQUEST, so the JSPs the Struts actions forward to are filtered too. Listing only the actions asanonis not enough —/pages/login.jsphas to be listed as well.2. HTTP 400 on a visitor's first request. With no session cookie yet, the container rewrote the redirect as
.../login.action;jsessionid=..., and Jetty 11 rejects that URI with400 Invalid request. It only affected the first request, which made it easy to miss — a reload appeared to "fix" it.The fix
shiro.inigains a[main]section pointingauthc.loginUrlat/login.action, and a[urls]chain that leaves the login path anonymous and protects everything else. Authentication itself stays programmatic inLoginAction;authconly decides where to send an unauthenticated visitor.web.xmlrestricts session tracking toCOOKIE, which stops the URL rewriting.Verification
Ran under
mvn jetty:runand exercised the flow in a browser and over HTTP:/→ login form renders (one redirect, no loop, no;jsessionid=)lonestarr→ welcome page showingWelcome lonestarr, theschwartzrole, and bothlightsaberandwinnebago:drive:eagle5permissions — so authentication, role resolution, and permission checks all work under Shiro 3.0.0welcome.actionafter logout → redirects to the login page, confirming the chain actually protects it rather than just being loop-freemvn clean testpasses on JDK 17.🤖 Generated with Claude Code