You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shiro.apache.org by "Allen-wick (via GitHub)" <gi...@apache.org> on 2026/06/09 09:44:11 UTC
[I] [Doc] Clarify that disabling principal parameter also disables JSR-250 annotations [shiro]
Allen-wick opened a new issue, #2763:
URL: https://github.com/apache/shiro/issues/2763
### Search before asking
- [x] I had searched in the [issues, **including closed issues**](https://github.com/apache/shiro/issues?q=is%3Aissue) and found no similar issues.
### Documentation Related
Currently, the documentation for the `shiro-jaxrs` module does not clearly state the cascading effects of the `org.apache.shiro.web.disable-principal` configuration parameter.
Specifically, if an operator sets this parameter to disable the principal, it inherently disables the processing of JSR-250 annotations (such as `@RolesAllowed`, `@DenyAll`), because these annotations require a valid principal to evaluate against.
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [I] [Doc] Clarify that disabling principal parameter also disables JSR-250 annotations [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak closed issue #2763: [Doc] Clarify that disabling principal parameter also disables JSR-250 annotations
URL: https://github.com/apache/shiro/issues/2763
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [I] [Doc] Clarify that disabling principal parameter also disables JSR-250 annotations [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on issue #2763:
URL: https://github.com/apache/shiro/issues/2763#issuecomment-4676934752
There is no cascading effect after all. JSR-250 annotations are handled by the Jakarta Rest / Jakarta Security unless principal propagation is disabled.
Only if the above is disabled, Shiro itself handles JSR-250 annotations
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org