Apache Shiro 3

Apply the Java 25 prompt first. These rules cover Apache Shiro 3 core, servlet security, and the integration modules used by the application, and were checked against 3.0.1. Shiro requires Java 17 or later; these rules target Java 25.

Runtime and configuration

• Declare all Shiro core, web, crypto, and integration artifacts with one shared version property and move them together; Shiro 3.0.1 publishes no shiro-bom, so check mvn dependency:tree or gradle dependencies for a Shiro module resolved at another version. Use the native jakarta.* web artifacts without the old jakarta classifier; select compatible Jakarta EE 10+ or Spring 7 / Spring Boot 4 integrations and check their own runtime requirements.
• Treat shiro.ini, Spring beans, realm lists, filter definitions, serializers, and SecurityManager construction as trusted executable configuration. Do not let request data select classes, beans, configuration locations, or security components; remove sample accounts and credentials.
• Track the official Shiro security reports for every deployed integration module. Preserve the fixes present in 3.0.1 when customizing login, remember-me, path resolution, LDAP DN construction, or Jakarta EE form resubmission.

Realms and authentication

• Authenticate through Subject.login(token) and accept success only after it returns normally. In a custom AuthenticatingRealm, return trusted stored credentials from doGetAuthenticationInfo, check account status, and restrict supports(token) to the intended token types; echo submitted credentials only after an