(shiro-site) branch main updated: enh: document cookie options

[lp...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git


The following commit(s) were added to refs/heads/main by this push:
     new 669b9c359 enh: document cookie options
669b9c359 is described below

commit 669b9c3595281d368cee0d84a71c5a080bc83753
Author: lprimak <le...@flowlogix.com>
AuthorDate: Thu Apr 30 10:35:21 2026 -0500

    enh: document cookie options
---
 src/site/content/jakarta-ee.adoc       |  5 +++++
 src/site/content/spring-boot.adoc      |  4 ++--
 src/site/content/spring-framework.adoc |  4 ++--
 src/site/content/troubleshooting.adoc  | 18 ++++++++++++++++++
 4 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc
index c35e7f953..dce8c9aed 100644
--- a/src/site/content/jakarta-ee.adoc
+++ b/src/site/content/jakarta-ee.adoc
@@ -183,6 +183,11 @@ RememberMe functionality is disabled by default. You can enable it easily by add
 ----
 authc.useRemembered = true
 ----
+RememberMe uses secure cookies by default. If you are running in non-HTTPS environment, you can disable secure cookies in Jakarta Faces' development mode only by adding the following to `shiro.ini` (this is the recommended configuration, but make sure production is running in Faces production mode):
+[source,properties]
+----
+securityManager.rememberMeManager.secureInDevMode = false
+----
 
 [#rate_limiting]
 ==== Rate limiting: Automatic delay when login failed
diff --git a/src/site/content/spring-boot.adoc b/src/site/content/spring-boot.adoc
index f01913128..b94347890 100644
--- a/src/site/content/spring-boot.adoc
+++ b/src/site/content/spring-boot.adoc
@@ -151,9 +151,9 @@ protected CacheManager cacheManager() {
 
 |shiro.rememberMeManager.cookie.domain |null |RememberMe cookie domain
 
-|shiro.rememberMeManager.cookie.path |null |RememberMe cookie path
+|shiro.rememberMeManager.cookie.path |ROOT_PATH |RememberMe cookie path
 
-|shiro.rememberMeManager.cookie.secure |`false` |RememberMe cookie secure flag
+|shiro.rememberMeManager.cookie.secure |`true` |RememberMe cookie secure flag
 
 |shiro.loginUrl |`/login.jsp` |Login URL used when unauthenticated users are redirected to login page
 
diff --git a/src/site/content/spring-framework.adoc b/src/site/content/spring-framework.adoc
index cc31253f4..53b04a061 100644
--- a/src/site/content/spring-framework.adoc
+++ b/src/site/content/spring-framework.adoc
@@ -254,9 +254,9 @@ age
 
 |shiro.rememberMeManager.cookie.domain |null |RememberMe cookie domain
 
-|shiro.rememberMeManager.cookie.path |null |RememberMe cookie path
+|shiro.rememberMeManager.cookie.path |ROOT_PATH |RememberMe cookie path
 
-|shiro.rememberMeManager.cookie.secure |`false` |RememberMe cookie
+|shiro.rememberMeManager.cookie.secure |`true` |RememberMe cookie
 secure flag
 
 |shiro.loginUrl |`/login.jsp` |Login URL used when unauthenticated users
diff --git a/src/site/content/troubleshooting.adoc b/src/site/content/troubleshooting.adoc
index cd78bd9cd..e9fd5a053 100644
--- a/src/site/content/troubleshooting.adoc
+++ b/src/site/content/troubleshooting.adoc
@@ -287,6 +287,24 @@ subject.isAuthenticated();
 subject.isRemembered();
 ----
 
+4. **Browser cookie issues**: Ensure the browser accepts cookies and that there are no domain/path mismatches.
+By default, Shiro's Remember Me cookie is HTTP-only and secure. If you're testing in a non-HTTPS environment, you may need to adjust the secure flag for testing purposes.
+You can use system property to control this behavior. Set `org.apache.shiro.rememberMe.secure.disabled` to `true` to disable the secure flag on the Remember Me cookie for testing.
+You can also configure this in your `shiro.ini`:
++
+[source,ini]
+----
+[main]
+securityManager.rememberMeManager.cookie.secure = false
+----
+For Jakarta EE applications, the secure flag is enabled by default. You can disable it for testing purposes in Jakarta Faces' Development mode only by setting the following in your shiro.ini:
++
+[source,ini]
+----
+[main]
+securityManager.rememberMeManager.secureInDevMode = false
+----
+
 === How do I generate a cipher key for Remember Me?
 
 Generate a secure key using Shiro's `AesCipherService`: