Take the 2-minute tour ×

Probably I'm in a kind of misunderstanding problem, but here is the thing:

  • I want my <domain>/index.html publicly available and everything else should be protected.

I'm using shiro web + guice:



addFilterChain("/index.html", ANON);
addFilterChain("/**", AUTHC);


This configuration is leading me to a "TOO MANY REDIRECTS LOOP" problem. Shiro documentation says here it uses a FIRST MATCH WIN policy, but I think I didn't get it well.

Any thoughts?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

On the surface, your filter chain looks like it should work. I probably can't diagnose your too many redirects issue without a bit more information - content of index.html, what http is actually returned from the server when you hit index.html, etc.

However, I CAN tell you that you shouldn't need to do this. The AUTHC filter has a special case for the "loginUrl" page - it will let it through. So try removing the ANON filter, and see how things go.

share|improve this answer
Nice! Actually your answer gave the right clues and I figured out that my index.html (which hosts a GWT module) tries to reach a few GWT content not allowed according to my filter policy above. Now I need to make GWT requests secure with Shiro only after the module has been loaded. Thanks!! –  Christian Feb 1 '13 at 18:48

Your Answer


