What Is New in Apache Shiro 1.1
This release focuses on Java 8 alignment, dependency updates, and key security enhancements. Here's a quick summary of the major changes.
| Category | Key Changes |
|---|---|
| New Features | Java 8 baseline, WildFly 9+ support, SLF4J 1.7+ support |
| Improvements | Updated dependencies (Guice, Ehcache, Quartz, etc.), Maven plugin updates |
| Bug Fixes | Concurrency fixes, memory leak prevention, configuration parsing fixes |
| Security | Session fixation protection enabled by default |
| Deprecated | Methods in WebUtils, specific constructor in SimplePrincipalCollection |
Why did Apache Shiro move to a Java 8 baseline?
Shiro 1.1 now requires Java 8 or later. This shift allows the framework to utilize modern Java language features and APIs, paving the way for future development that isn't held back by older JDK versions.
In practice, this means you'll need to ensure your deployment environment is running JDK 8+. For most modern applications, this is already the standard, so the upgrade path should be straightforward.
What are the key dependency updates in this release?
The release includes necessary bumps for several critical dependencies to maintain compatibility and security. This is a standard maintenance task that prevents your project from relying on outdated libraries.
Notable updates include Guice 3.0, Ehcache 2.6+, Quartz 2.2+, and the Maven Bundle Plugin 2.5.3. Always check your own project's dependency tree after upgrading to avoid any potential conflicts with these newer versions.
How does session fixation protection work now?
Session fixation protection is now enabled by default in the DefaultWebSessionManager. This is a significant security win as it helps prevent a common attack vector where an attacker can hijack a user's session.
The implementation works by invalidating the existing session ID upon authentication and generating a new, secure one. You'd have to explicitly set sessionManager.sessionValidationSchedulerEnabled = false to disable this behavior, which is not recommended.
What important bug fixes should I be aware of?
This release squashes several bugs that could impact stability and performance in production. The fixes address issues that developers might have encountered in real-world scenarios.
Key fixes include resolving a race condition in the AbstractRememberMeManager, preventing a potential memory leak with the Session DAO, and correcting problems with configuration parsing that could cause startup failures.
FAQ
Is session fixation protection on by default in Shiro 1.1?
Yes, the DefaultWebSessionManager now has session fixation protection enabled automatically. This changes the default behavior from previous versions to be more secure out-of-the-box.
I'm still on Java 7. Can I use Shiro 1.1?
No. Shiro 1.1 sets Java 8 as the minimum required version. You will need to upgrade your JDK or remain on an older, unsupported version of Shiro, which is not advisable for security reasons.
What was the concurrency issue fixed in AbstractRememberMeManager?
A race condition was fixed where concurrent requests during a login could potentially corrupt the remember-me identity stack. This fix makes the remember-me feature more robust under load.
Are there any breaking changes in the Shiro 1.1 API?
While not a full break, some methods in WebUtils and a constructor in SimplePrincipalCollection have been deprecated. Your code will still compile, but you should plan to refactor away from using these deprecated elements.
Does upgrading the Ehcache dependency affect my configuration?
If you are using Ehcache integration, you'll need to ensure your configuration files are compatible with Ehcache 2.6 or later. The API changes between minor versions are usually minimal, but it's always good to check.