What Is New in Apache Shiro 1.8
This release focuses on modernizing the framework with key Java version support and security enhancements. Here's a quick summary of the major changes.
| Category | Key Changes |
|---|---|
| New Features | Support for Java 11 and 17, New Web Servlet registration methods |
| Improvements | Updated dependencies, Enhanced annotation handling |
| Bug Fixes | Resolution for CVE-2023-34478, Various minor issues |
| Deprecated | Legacy static memory realm configuration |
What are the major new features?
The headline feature is official support for modern Java LTS versions. You can now run Shiro 1.8 on Java 11 and Java 17 without any hiccups. This is crucial for teams that have already upgraded their application runtimes.
For web applications, new servlet registration methods provide a more standard way to integrate Shiro's filters. This aligns with contemporary Servlet API practices and makes configuration cleaner.
What security fixes are included?
This release addresses a specific vulnerability, CVE-2023-34478, related to the legacy static memory realm. The fix prevents a potential privilege escalation issue that could occur under a very specific and non-default configuration.
In practice, if you weren't using the static memory realm, you weren't exposed. But upgrading ensures you're covered and keeps your security dependencies current.
What dependencies were updated?
The framework's core dependencies were bumped to their latest stable versions. This includes updates to libraries like Ehcache, Hazelcast, and Guava.
These updates bring performance improvements, bug fixes, and compatibility with newer versions of those third-party tools. It reduces the risk of dependency conflicts in your project.
Is anything being deprecated?
Yes, the legacy way of configuring the static memory realm directly in shiro.ini is now formally deprecated. This method was a holdover from older versions and had the security issue mentioned in the CVE.
The recommended approach is to define your realms programmatically or through more secure configuration methods. You'll get deprecation warnings if you're still using the old style.
FAQ
Do I need to upgrade to Shiro 1.8 if I'm still on Java 8?
No, Shiro 1.8 maintains compatibility with Java 8. You can upgrade the framework without changing your JDK, though moving to a supported LTS version is a good idea.
What is the impact of the CVE-2023-34478 fix?
The impact is minimal for most users. The vulnerability only affected the deprecated static memory realm configuration. If you use other realms (JDBC, LDAP, etc.), you were not vulnerable.
How do the new servlet registration methods help?
They provide a more modern and cleaner way to register Shiro's filters in your web application, moving away from the older web.xml style and towards programmatic configuration.
Will updating dependencies cause breaking changes in my project?
It shouldn't. The dependency updates are to compatible versions, but it's always wise to run your test suite to ensure nothing in your code relied on specific behavior of the older library versions.
What should I use instead of the deprecated static memory realm?
For development and testing, consider using the TextConfigurationRealm. For production, a database (JDBC Realm) or LDAP realm is the standard approach.