Fork me on GitHub

Apache Shiro Logo Simple. Java. Security. Apache Software Foundation Event Banner

Published by  on the

The Shiro team is pleased to announce the release of Apache Shiro version 1.10.0. This is a feature release for 1.x.

This release solves 7 issues since the 1.9.1 release and is available for download now.

All changes

You can learn more on Jira, Release 1.10.0.


Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

Credit: Apache Shiro would like to thank Y4tacker for reporting this issue.


  • [SHIRO-512] - Race condition in Shiro’s web container session timeout handling

  • [SHIRO-887] - FormAuthenticationFilter trims passwords which start and/or end with one or more space character(s)


  • [SHIRO-891] - fix source jar Reproducible Builds issue

  • [SHIRO-884] - fix source jar Reproducible Builds issue

  • [SHIRO-885] - Use OWASP Java Encoder with OSGi manifest

  • [SHIRO-890] - Avoid another proxy creator when @EnableAspectJAutoProxy enabled

  • [SHIRO-891] - Allow for direct configuration of ShiroFilter through WebEnvironment

Dependency upgrade

  • Many dependency updates

Behavior Changes

As of 1.10.0, Shiro may filter a request multiple times, e.g. when including or forwarding requests.

This behavior can be reverted by setting the following property: shiro.filterOncePerRequest=true


Download and verification instructions are available on our download page.


For more information on Shiro, please read the documentation.


The Apache Shiro Team