Apache Shiro 1.2.0版发布

最新推荐文章于 2022-08-01 14:24:20 发布

原创最新推荐文章于 2022-08-01 14:24:20 发布 · 1.4k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#shiro #apache #passwords #initialization #documentation #filter

Shiro 专栏收录该内容

56 篇文章

订阅专栏

2012年1月24日，Shiro团队发布Apache Shiro 1.2.0版本。该版本修复了BUG并增加了多项新特性，如禁用会话的能力、支持在web应用中初始化ServletContextListener、命令行工具用于安全地哈希密码等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

2012年1月24日，Shiro小组发布了Apache Shiro 1.2.0版。此版本在修改BUG的同时增加了一些新功能。

这些新功能包括：

The ability to disable sessions per filter chain or entirely for an application.
Servlet Context Listener initialization in web apps (to allow components to utilize Shiro before Filter initialization)
A command line program to securely hash passwords (or any url, file or stream input for that matter).
New secure password hash formats that adhere to Modular Crypt Format conventions. These secure password hashes can be computed with the above named command line program and saved in text config (e.g. shiro.ini) directly. Plaintext passwords should never be stored. For those familiar with the Apache HTTPD passwd program, this achieves the same benefits.
A new LogoutFilter, as many apps don't need to show a view during logout (just logout and redirect to some known location).
Shiro filters can be enabled or disabled without removing them from the filter chain - useful in development (e.g. turn ssl requirement off in dev, but keep it on in production).
A lot of work has gone into making secure password hash storage and comparison a much simpler task in Shiro, focused around the new concept of a PasswordService. You can use a PasswordService directly in your application code to hash passwords securely. You can then configure a PasswordMatcher on your Realm(s) to use the same PasswordService for password comparisons. See the PasswordService JavaDoc for example .ini configuration:
- PasswordService: http://shiro.apache.org/static/current/apidocs/org/apache/shiro/authc/credential/PasswordService.html
- PasswordMatcher: http://shiro.apache.org/static/current/apidocs/org/apache/shiro/authc/credential/PasswordMatcher.html

More complete PasswordService and related configdocumentation will be added to the Shiro website in the next few days - itwas better to release now for the many who are waiting on the release, andfollow up with this part of the documentation shortly.

Three new 'support' modules:
- Apache Karaf features (shiro-features-1.2.0.jar)
- Google Guice: http://shiro.apache.org/guice.html
- Jasig CAS: http://shiro.apache.org/cas.html