Apache Shiro™ is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.

If deploying inside a web application, by default the Session will be HttpSession based.But, in a non-web environment, like this simple Quickstart, Shiro will automatically use its Enterprise Session Management by default. This means you get to use the same API in your applications, in any tier, regardless of deployment environment.

Download Apache Shiro, a Java security framework, from this page.

Apache Shiro aims to be the most comprehensive, but also the easiest to use Java security framework available. Here are some of the frameworks finer points: The easiest to understand Java Security API anywhere.

While we hope this documentation helps you with the work you're doing with Apache Shiro, the community is improving and expanding the documentation all the time. If you'd like to help the Shiro project, please consider correcting, expanding, or adding documentation where you …

To that end, Shiro provides a default ‘common denominator’ solution via text-based INI configuration. People are pretty tired of using bulky XML files these days, and INI is easy to read, simple to use, and requires very few dependencies.

Introduction to the Apache Shiro Java Security Framework A high-level overview of Apache Shiro’s capabilities. Architecture An architectural overview of Apache Shiro. Terminology A list of definitions of common security concepts and concerns. Apache Shiro Project Background Apache Shiro, like most useful tools, was created out of necessity ...

Shiro’s Spring-Boot integration is the easiest way to integrate Shiro into a Spring-base application, for more general Spring Framework integration, take the annotation or XML guides.

Web Support: Shiro’s web support APIs help easily secure web applications. Caching: Caching is a first-tier citizen in Apache Shiro’s API to ensure that security operations remain fast and efficient. Concurrency: Apache Shiro supports multithreaded applications …

The simplest way to integrate Shiro into any web application is to configure a Servlet ContextListener and Filter in web.xml that understands how to read Shiro’s INI configuration. The bulk of the INI config format itself is defined in the Configuration pages’s INI Sections section, but we’ll cover some additional web-specific sections here.