OSS TanbouOn this page
Overview
Apache Shiro is a Java security framework for authentication, authorization, cryptography, and session management. Its API can secure applications ranging from small programs to web and enterprise systems.
Features and best fit
Based on official documentation; not hands-on tested · Content checked:
Key features
Handle authentication and authorization through a shared security API
The README identifies authentication, authorization, cryptography, and session management as Shiro's core capabilities.
Sources: [2]
Apply the security model across different kinds of Java applications
Shiro is intended for applications ranging from small deployments to web and enterprise systems rather than being tied to one specific container.
Sources: [2]
Best fit
Fits Java backends that want explicit control over identity, permissions, and sessions
It is a candidate when teams want to compose application security around Shiro APIs instead of delegating the full model to a larger application framework.
Sources: [2]
Before adoption
Follow security updates around RememberMe serialization and request paths
Version 3.0.1 adds JEP-290 ObjectInputFilter support for RememberMe deserialization, replay controls, fail-closed request-path normalization, and related security hardening.
Sources: [3]
Official sources
- [1]apache/shiro — GitHub repository(2026-10-06)
- [2]Apache Shiro — README(2026-10-06)
- [3]Apache Shiro 3.0.1 release(2026-10-06)
Supplemental curator note
It fits Java applications that need authentication and authorization without tying security to a single web stack. Keep RememberMe, session serialization, and request-path handling current with security patch releases.
Try it in 3 steps
- 1
Get the source
git clone --depth 1 https://github.com/apache/shiro.git - 2
Enter the repository
cd shiro - 3
Check the official steps
Continue with the commands in the README Installation, Quick Start, or Getting Started section.
find . -maxdepth 1 -iname 'README*' -exec sed -n '1,220p' {} \; -quit
Growth
Growth trends · Last 30 days
4,460 Stars
Trend data is still being collected.
Built with
Categories and tags
Categories
GitHub data
GitHub dataView detailed GitHub data
GitHub Topics
- java
- library
- shiro
- web-framework
- Stars
- 4,460
- Forks
- 2,291
- Watchers
- 4,460
- Open issues
- 7
- Contributors
- 82
- Owner type
- Organization
- Primary language
- Java
- License
- Apache-2.0
- Repository last updated
- Oct 1, 2026
Related information
Write a related articleShare a guide or use case for this OSS in Markdown. Articles are published after administrator approval.
Explore next
- Unkey5,457 Stars
2 shared tag(s) · 1 shared category(s)
manage API keys, rate limits, RBAC, and gateway policy on one API platform
Go - SPIRE2,571 Stars
2 shared tag(s) · 1 shared category(s)
attest running workloads and issue short-lived SVID credentials bound to SPIFFE identities
Go - FreeIPA1,290 Stars
2 shared tag(s) · 1 shared category(s)
centralize Linux identity and access with LDAP, Kerberos, PKI, DNS, sudo, and access-control policy
Python - Spring Boot81,561 Stars
2 shared tag(s) · Same language
put Spring application assembly and operations on a common foundation
Java - Spring Framework60,273 Stars
2 shared tag(s) · Same language
Directly assemble Java dependency injection, MVC or WebFlux, data access, and transaction infrastructure
Java - JJWT11,138 Stars
3 shared tag(s) · 2 shared category(s) · Same language
create and verify JWT, JWS, JWE, and JWK through an RFC-oriented fluent Java API
Java
Report incorrect information
Tell us if any listing information is incorrect or outdated.