Various bug fixes

core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java

@@ -22,7 +22,6 @@
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.SimpleAuthenticationInfo;
-import org.apache.shiro.authc.credential.AllowAllCredentialsMatcher;
 import org.apache.shiro.authz.AuthorizationException;
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.ldap.UnsupportedAuthenticationMechanismException;
@@ -109,8 +108,6 @@ public class DefaultLdapRealm extends AuthorizingRealm {
      * {@link JndiLdapContextFactory}.
      */
     public DefaultLdapRealm() {
-        //Credentials Matching is not necessary - the LDAP directory will do it automatically:
-        setCredentialsMatcher(new AllowAllCredentialsMatcher());
         //Any Object principal and Object credentials may be passed to the LDAP provider, so accept any token:
         setAuthenticationTokenClass(AuthenticationToken.class);
         this.contextFactory = new JndiLdapContextFactory();

core/src/test/java/org/apache/shiro/realm/ldap/DefaultLdapRealmTest.java

@@ -21,7 +21,7 @@
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.UsernamePasswordToken;
-import org.apache.shiro.authc.credential.AllowAllCredentialsMatcher;
+import org.apache.shiro.authc.credential.SimpleCredentialsMatcher;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -61,7 +61,7 @@ public void setUp() {
 
     @Test
     void testDefaultInstance() {
-        assertThat(realm.getCredentialsMatcher() instanceof AllowAllCredentialsMatcher).isTrue();
+        assertThat(realm.getCredentialsMatcher() instanceof SimpleCredentialsMatcher).isTrue();
         assertThat(realm.getAuthenticationTokenClass()).isEqualTo(AuthenticationToken.class);
         assertThat(realm.getContextFactory() instanceof JndiLdapContextFactory).isTrue();
     }

support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java

@@ -109,6 +109,7 @@ public class FormResubmitSupport {
     static final String FORM_RESUBMIT_WHITELIST = "org.apache.shiro.form-resubmit-whitelist";
     static final String FORM_RESUBMIT_BLACKLIST = "org.apache.shiro.form-resubmit-blacklist";
     static final String FORM_DATA_CACHE = "org.apache.shiro.form-data-cache";
+    static final String FORM_DATA_KEY_PREFIX = "formDataKey=";
     // encoded view state
     private static final String FACES_VIEW_STATE = "jakarta.faces.ViewState";
     private static final String FACES_VIEW_STATE_EQUALS = FACES_VIEW_STATE + "=";
@@ -572,7 +573,7 @@ private static String processResubmitResponse(HttpResponse<String> response,
                         .entrySet().stream().filter(not(entry -> entry.getKey()
                                 .startsWith(getSessionCookieName(servletContext, getSecurityManager()))))
                         .forEach(entry -> addCookie(originalResponse, servletContext,
-                                entry.getKey(), entry.getValue(), -1, false));
+                                entry.getKey(), entry.getValue()));
                 if ((response.statusCode() == FOUND || redirect) && isPartialAjaxRequest) {
                     originalResponse.setHeader(CONTENT_TYPE, TEXT_XML);
                     originalResponse.setCharacterEncoding(StandardCharsets.UTF_8.name());
@@ -742,7 +743,7 @@ private static boolean checkWhitelistClient(URI savedRequestURI, String contextP
                             contextPath, FORM_RESUBMIT_CHECK_SERVLET_PATH)))
                     .timeout(Duration.ofSeconds(3)).header(CONTENT_TYPE, "text/plain")
                     .POST(HttpRequest.BodyPublishers.ofString(rememberMeManager.getCipherService()
-                            .encrypt(savedFormDataKey.getBytes(StandardCharsets.UTF_8),
+                            .encrypt((FORM_DATA_KEY_PREFIX + savedFormDataKey).getBytes(StandardCharsets.UTF_8),
                                     rememberMeManager.getEncryptionCipherKey()).toBase64())).build();
             var response = client.send(request, HttpResponse.BodyHandlers.ofString());
 

support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupportCookies.java

@@ -22,6 +22,7 @@
 import java.time.Duration;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 import jakarta.servlet.ServletContext;
@@ -59,6 +60,18 @@ static void addCookie(@NonNull HttpServletResponse response, ServletContext serv
         response.addCookie(cookie);
     }
 
+    static void addCookie(@NonNull HttpServletResponse response, ServletContext servletContext,
+                          @NonNull String cookieName, @NonNull HttpCookie inputCookie) {
+        var cookie = new Cookie(cookieName, inputCookie.getValue());
+        cookie.setPath(inputCookie.getPath() != null ? inputCookie.getPath() : servletContext.getContextPath());
+        cookie.setMaxAge(Math.toIntExact(inputCookie.getMaxAge()));
+        cookie.setHttpOnly(inputCookie.isHttpOnly());
+        if (EnvironmentLoaderListener.isFormResubmitSecureCookies(servletContext)) {
+            cookie.setSecure(true);
+        }
+        response.addCookie(cookie);
+    }
+
     static void deleteCookie(@NonNull HttpServletResponse response, ServletContext servletContext,
             @NonNull String cookieName) {
         var cookieToDelete = new Cookie(cookieName, "tbd");
@@ -94,9 +107,9 @@ static String getSessionCookieName(ServletContext context, org.apache.shiro.mgt.
         }
     }
 
-    static Map<String, String> transformCookieHeader(@NonNull List<String> cookies) {
+    static Map<String, HttpCookie> transformCookieHeader(@NonNull List<String> cookies) {
         return cookieStreamFromHeader(cookies)
-                .collect(Collectors.toMap(HttpCookie::getName, HttpCookie::getValue, (var, v2) -> v2));
+                .collect(Collectors.toMap(HttpCookie::getName, Function.identity(), (var, v2) -> v2));
     }
 
     static Stream<HttpCookie> cookieStreamFromHeader(@NonNull List<String> cookies) {

support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitValidator.java

@@ -31,6 +31,7 @@
 import java.util.stream.Collectors;
 import static org.apache.shiro.SecurityUtils.getSecurityManager;
 import static org.apache.shiro.ee.filters.FormResubmitSupport.FORM_DATA_CACHE;
+import static org.apache.shiro.ee.filters.FormResubmitSupport.FORM_DATA_KEY_PREFIX;
 import static org.apache.shiro.ee.filters.FormResubmitSupport.decrypt;
 import static org.apache.shiro.ee.filters.FormResubmitSupport.getRememberMeManager;
 import static org.apache.shiro.web.filter.authc.NoAccessFilter.FORM_RESUBMIT_CHECK_SERVLET_PATH;
@@ -45,7 +46,8 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
             response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
         } else {
             try {
-                String formDataKey = decrypt(request.getReader().lines().collect(Collectors.joining()), rememberMeManager);
+                String formDataKey = decrypt(request.getReader().lines().collect(Collectors.joining()), rememberMeManager)
+                        .substring(FORM_DATA_KEY_PREFIX.length());
                 var cache = getSecurityManager(DefaultSecurityManager.class)
                         .getCacheManager().getCache(FORM_DATA_CACHE);
                 Optional.ofNullable(cache.get(UUID.fromString(formDataKey))).orElseThrow(IllegalCallerException::new);

support/jakarta-ee/src/test/java/org/apache/shiro/ee/filters/FormSupportTest.java

@@ -23,11 +23,13 @@
 import static org.apache.shiro.ee.filters.FormResubmitSupport.noJSFAjaxRequests;
 import static org.apache.shiro.ee.filters.FormResubmitSupportCookies.transformCookieHeader;
 
+import java.net.HttpCookie;
 import java.net.URLDecoder;
 import java.time.Duration;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 import jakarta.servlet.http.HttpServletRequest;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -327,11 +329,21 @@ void clientSideStateSavingNoAjax() {
 
     @Test
     void parseCookies() {
-        var map = Map.of("name1", "value1", "name2", "value2", "name3", "value3");
+        var map = Map.of("name1", "value1", "name2", "value2", "name3", "value3")
+                .entrySet().stream()
+                .collect(Collectors.toUnmodifiableMap(Map.Entry::getKey,
+                        entry -> {
+                            var cookie = new HttpCookie(entry.getKey(), entry.getValue());
+                            if (entry.getKey().equals("name2")) {
+                                cookie.setPath("/my/path");
+                            }
+                            return cookie;
+                        }));
+
         assertThat(transformCookieHeader(List.of("name1=value1", "name2=value2; path=/my/path", "name3=value3"))).isEqualTo(map);
-        assertThat(transformCookieHeader(List.of("name="))).isEqualTo(Map.of("name", ""));
+        assertThat(transformCookieHeader(List.of("name="))).isEqualTo(Map.of("name", new HttpCookie("name", "")));
         assertThat(transformCookieHeader(List.of("JSESSIONID=\"abc\"; $Version=\"1\"; $Path=\"/mypath\"")))
-            .isEqualTo(Map.of("JSESSIONID", "abc"));
+            .isEqualTo(Map.of("JSESSIONID", new HttpCookie("JSESSIONID", "abc")));
     }
 
     @Test

web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java

@@ -423,20 +423,19 @@ private static String toCookieDate(Date date) {
     @Override
     public void removeFrom(HttpServletRequest request, HttpServletResponse response) {
         String name = getName();
-        String value = DELETED_COOKIE_VALUE;
         //don't need to add extra size to the response - comments are irrelevant for deletions
         String comment = null;
         String domain = getDomain();
         String path = calculatePath(request);
         //always zero for deletion
         int maxAge = 0;
         int version = getVersion();
-        boolean secure = isSecure();
+        boolean secure = isSecure() && request.isSecure();
         //no need to add the extra text, plus the value 'deleteMe' is not sensitive at all
         boolean httpOnly = false;
         SameSiteOptions sameSite = getSameSite();
 
-        addCookieHeader(response, name, value, null, domain, path, maxAge, version, secure, httpOnly, sameSite);
+        addCookieHeader(response, name, DELETED_COOKIE_VALUE, null, domain, path, maxAge, version, secure, httpOnly, sameSite);
 
         LOGGER.trace("Removed '{}' cookie by setting maxAge=0", name);
     }

web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java

@@ -241,6 +241,7 @@ void getRememberedPrincipalsNoMoreDefaultCipher() {
             };
 
             expect(mockRequest.getCookies()).andReturn(cookies);
+            expect(mockRequest.isSecure()).andReturn(false);
             replay(mockRequest);
 
             CookieRememberMeManager mgr = new CookieRememberMeManager();
@@ -350,6 +351,7 @@ void shouldIgnoreInvalidCookieValues() {
         expect(mockRequest.getAttribute(ShiroHttpServletRequest.IDENTITY_REMOVED_KEY)).andReturn(null);
         expect(mockRequest.getContextPath()).andReturn(null);
         expect(mockRequest.getCookies()).andReturn(cookies);
+        expect(mockRequest.isSecure()).andReturn(false);
         replay(mockRequest);
 
         // when