lukaszlenart commented on PR #536: URL: https://github.com/apache/struts-examples/pull/536#issuecomment-5293169861
Followed up with a manual runtime test in a browser, as suggested above. **The result reverses my earlier assessment: this PR is not a risky major bump — it is a required fix.** ### `shiro-basic` does not start on current `main` Running `mvn jetty:run` on `main` (Shiro 2.2.1) fails at startup: ``` java.lang.ClassNotFoundException: javax.servlet.ServletContextListener ``` Shiro 2.2.1 is still built against **javax** servlet, while this project provides **Jakarta** Servlet 6.1. Confirmed directly in the jars: - `shiro-web-2.2.1.jar` → `EnvironmentLoaderListener` references `javax/servlet/ServletContext` - `shiro-web-3.0.0.jar` → references `jakarta/servlet/ServletContext` So the `EnvironmentLoaderListener` declared in `web.xml` cannot load, and the context never deploys. With 3.0.0 the app starts in ~6s with no `ClassNotFoundException`/`NoClassDefFoundError` at all. CI could never have caught this: `shiro-basic` has no tests, so `mvn test` only proves compilation, and the failure is a runtime classloading one. ### But merging this alone will not make the example work With 3.0.0 the app boots, yet the login flow is still broken by **pre-existing configuration** unrelated to the Shiro version: 1. `shiroFilter` is mapped to `/*`, and `shiro.ini` has no `[main]` or `[urls]` section, so Shiro falls back to its default `loginUrl` of `/login.jsp`. 2. There is no `login.jsp` at the webapp root — the actual form is `pages/login.jsp`. Every request therefore redirects to a page that redirects again: I measured an **infinite redirect loop** (50 redirects, still 302). 3. On a first visit with no session cookie, the redirect is URL-rewritten to `.../login.jsp;jsessionid=...`, and Jetty 11.0.18 rejects that URI with **HTTP 400 Invalid request**. With a cookie present the rewriting stops, so this one only bites the first request. `shiro.ini` has not changed since the 2017 initial commit, so items 1 and 2 long predate this PR. ### Suggestion Merge this — it strictly improves the module (from "will not start" to "starts"), and 3.0.0 is the only version compatible with this project's Jakarta baseline. Then track the login-flow breakage separately: it needs a `[main]` section setting `loginUrl = /pages/login.jsp` (plus a `[urls]` chain definition), which is a different change from a dependency bump. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
