(shiro-site) branch asf-site updated: enh: content 5/1/2026

[lp...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git


The following commit(s) were added to refs/heads/asf-site by this push:
     new 959b7a525 enh: content 5/1/2026
959b7a525 is described below

commit 959b7a5256a871327560acd7279dadddb1cb707e
Author: lprimak <le...@flowlogix.com>
AuthorDate: Fri May 1 12:55:45 2026 -0500

    enh: content 5/1/2026
---
 .well-known/security.txt |  2 +-
 feed.xml                 |  2 +-
 jakarta-ee.html          | 14 ++++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.well-known/security.txt b/.well-known/security.txt
index dba778917..762bf5cc7 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
 Contact: mailto:security@shiro.apache.org
-Expires: 2027-04-30T15:35:49Z
+Expires: 2027-05-01T17:55:02Z
 Preferred-Languages: en
 Canonical: https://shiro.apache.org/.well-known/security.txt
 Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index bac4ca961..f9cc4586e 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
   <subtitle>Simple. Java. Security.</subtitle>
   <link href="https://shiro.apache.org/"/>
   <link rel="self" href="https://shiro.apache.org/feed.xml" />
-  <updated>2026-04-30T15:35:50Z</updated>
+  <updated>2026-05-01T17:55:02Z</updated>
 
   <author>
     <name>Les Hazlewood</name>
diff --git a/jakarta-ee.html b/jakarta-ee.html
index 45f8322a3..296d7e4ac 100644
--- a/jakarta-ee.html
+++ b/jakarta-ee.html
@@ -702,6 +702,20 @@ To disable automatic bootstrapping, add the following to <code>web.xml</code>:</
 </div>
 </div>
 <div class="paragraph">
+<p>Ordinarily, Shiro sets session cookies to be secure, unless you are in Jakarta Faces' Development mode.
+Make sure to run in other than Development mode in production, so that secure cookies are used.
+If secure session cookies are not desired, you can disable them by adding the following to <code>web.xml</code>:</p>
+</div>
+<div class="listingblock">
+<div class="title">Note: this parameter is only available in Shiro 2.1.1 or later</div>
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;context-param&gt;
+    &lt;param-name&gt;org.apache.shiro.ee.secure-session-cookie.disabled&lt;/param-name&gt;
+    &lt;param-value&gt;true&lt;/param-value&gt;
+&lt;/context-param&gt;</code></pre>
+</div>
+</div>
+<div class="paragraph">
 <p>Ordinarily, Jakarta EE integration module will remove URL session tracking mode from the configuration, overriding any other session tracking configuration specified in <code>web.xml</code>. This is to align with good security practices. If URL tracking mode is desired (such as for testing or historical reasons), add the following to <code>web.xml</code>:</p>
 </div>
 <div class="listingblock">