title: Why doesn't Shiro's AnonymousFilter create new web sessions in this example?
body: <p>I have two applications secured with Shiro allowing anonymous access to all pages. One is a WAR deployed inside a Jetty server, and the other is a standalone Java application with an embedded Jetty server.</p>
  
  <ol>
  <li>Why does the standalone app not create sessions but the WAR app does?</li>
  <li>How do I configure the standalone app so that sessions are created?</li>
  <li>Why does the standalone app require the session manager to be explicitly defined in the shiro.ini but the WAR app does not? (Removing it means the authcBasic filter doesn't work either).</li>
  </ol>
  
  <h3>WAR app</h3>
  
  <p>WEB-INF/shiro.ini:</p>
  
  <pre><code>[main]
  sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
  securityManager.sessionManager = $sessionManager
  
  [urls]
  /** = anon
  </code></pre>
  
  <p>WEB-INF/web.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
       version="3.1"&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.apache.shiro.web.env.EnvironmentLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;ShiroFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.shiro.web.servlet.ShiroFilter&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;ShiroFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
      &lt;dispatcher&gt;FORWARD&lt;/dispatcher&gt;
      &lt;dispatcher&gt;INCLUDE&lt;/dispatcher&gt;
      &lt;dispatcher&gt;ERROR&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
  
  &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;home.jsp&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>home.jsp:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;body&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>pom.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!--suppress osmorcNonOsgiMavenDependency --&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"&gt;
  
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
  
      &lt;groupId&gt;com.foo.example&lt;/groupId&gt;
      &lt;artifactId&gt;apache-shiro-tutorial-webapp&lt;/artifactId&gt;
      &lt;version&gt;1.0.0-SNAPSHOT&lt;/version&gt;
      &lt;name&gt;Apache Shiro Tutorial Webapp&lt;/name&gt;
      &lt;packaging&gt;war&lt;/packaging&gt;
  
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.eclipse.jetty&lt;/groupId&gt;
                  &lt;artifactId&gt;jetty-maven-plugin&lt;/artifactId&gt;
                  &lt;version&gt;9.1.0.v20131115&lt;/version&gt;
                  &lt;configuration&gt;
                      &lt;webApp&gt;
                          &lt;contextPath&gt;/&lt;/contextPath&gt;
                      &lt;/webApp&gt;
                  &lt;/configuration&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
              &lt;artifactId&gt;shiro-core&lt;/artifactId&gt;
              &lt;version&gt;1.2.2&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
              &lt;artifactId&gt;shiro-web&lt;/artifactId&gt;
              &lt;version&gt;1.2.2&lt;/version&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
  &lt;/project&gt;
  </code></pre>
  
  <h3>Standalone app</h3>
  
  <p>classpath:shiro.ini:</p>
  
  <pre><code>[main]
  sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
  securityManager.sessionManager = $sessionManager
  
  [urls]
  /** = anon
  </code></pre>
  
  <p>Main.java:</p>
  
  <pre><code>import org.apache.shiro.SecurityUtils;
  import org.apache.shiro.web.env.EnvironmentLoaderListener;
  import org.apache.shiro.web.servlet.ShiroFilter;
  import org.eclipse.jetty.server.Server;
  import org.eclipse.jetty.servlet.FilterHolder;
  import org.eclipse.jetty.servlet.ServletContextHandler;
  import org.eclipse.jetty.servlet.ServletHolder;
  
  import javax.servlet.DispatcherType;
  import javax.servlet.ServletException;
  import javax.servlet.http.HttpServlet;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  import java.io.IOException;
  
  import static java.util.EnumSet.allOf;
  
  public class Main {
  
      public static void main(String[] args) throws Exception {
          Server server = new Server(8080);
          ShiroFilter shiroFilter = new ShiroFilter();
  
          ServletContextHandler context = new ServletContextHandler();
          context.addEventListener(new EnvironmentLoaderListener());
          context.setContextPath("/");
          context.addFilter(new FilterHolder(shiroFilter), "/", allOf(DispatcherType.class));
          context.addServlet(new ServletHolder(dummyServlet), "/");
  
          server.setHandler(context);
  
          server.start();
          SecurityUtils.setSecurityManager(shiroFilter.getSecurityManager());
          server.join();
      }
  
      private static HttpServlet dummyServlet = new HttpServlet() {
          @Override
          protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
              resp.getWriter().write("OK");
          }
      };
  }
  </code></pre>
  
  <p>pom.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
  
      &lt;groupId&gt;test&lt;/groupId&gt;
      &lt;artifactId&gt;test&lt;/artifactId&gt;
      &lt;version&gt;1.0-SNAPSHOT&lt;/version&gt;
  
  &lt;dependencies&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.eclipse.jetty&lt;/groupId&gt;
          &lt;artifactId&gt;jetty-server&lt;/artifactId&gt;
          &lt;version&gt;9.3.1.v20150714&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.eclipse.jetty&lt;/groupId&gt;
          &lt;artifactId&gt;jetty-servlet&lt;/artifactId&gt;
          &lt;version&gt;9.3.1.v20150714&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
          &lt;artifactId&gt;shiro-core&lt;/artifactId&gt;
          &lt;version&gt;1.2.2&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
          &lt;artifactId&gt;shiro-web&lt;/artifactId&gt;
          &lt;version&gt;1.2.2&lt;/version&gt;
      &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
              &lt;artifactId&gt;slf4j-api&lt;/artifactId&gt;
              &lt;version&gt;1.7.5&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
              &lt;artifactId&gt;jcl-over-slf4j&lt;/artifactId&gt;
              &lt;version&gt;1.7.5&lt;/version&gt;
              &lt;scope&gt;runtime&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;ch.qos.logback&lt;/groupId&gt;
              &lt;artifactId&gt;logback-classic&lt;/artifactId&gt;
              &lt;version&gt;1.0.13&lt;/version&gt;
              &lt;scope&gt;runtime&lt;/scope&gt;
          &lt;/dependency&gt;
  &lt;/dependencies&gt;
  
  &lt;/project&gt;
  </code></pre>
  
  <h2>Proving the standalone app works (and therefore the AnonymousFilter is the problem)</h2>
  
  <p>In the standalone app, if I replace the shiro.ini file with:</p>
  
  <pre><code>[main]
  sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
  securityManager.sessionManager = $sessionManager
  
  [users]
  name = password
  
  [urls]
  /** = authcBasic
  </code></pre>
  
  <p>then I can log in as "name" and a session <em>is</em> created. It seems to only be the anonymous filter which refuses to create sessions.</p>
  
  <h3>Other info</h3>
  
  <p>When I say "a session is created" I mean when I browse to localhost:8080/ the I can see the <code>Set-Cookie: JSESSIONID=blahblahblah</code> header in the response from the server. No such cookie is ever set by the anonymous filter in the standalone app.</p>