Apache Shiro

Apache Shiro is a security library Java developers drop into an app to handle logins, permissions, password hashing, and user sessions. Its pitch is independence. It works in plain Java programs, not just web apps, and does not force Spring or an application server on you. Apache 2.0, free, and run by the Apache Software Foundation.

Nothing to host. You add the Maven dependencies, configure realms (where your users live) and filter chains, and it runs inside your app. The ops burden is upgrades. Version 3 became the current line in June 2026 and needs Java 17, Jakarta EE 9 or later, and Spring 6 or later if you use Spring. The EhCache and Hazelcast modules are gone in favor of JCache, and 3.0 ships other breaking changes.

Free at every size. Teams already on Spring Boot should use Spring Security, which has first-party OAuth 2.0 and SAML support. Shiro only gets OAuth through community integrations like pac4j. Pick Shiro for non-Spring apps, or when you want sessions without a web container.

The catch: 2026 has been a rough security year. The project published ten CVEs after none since 2023, including a session fixation bug in default configurations. One of them affects 2.x through 3.0.0, and the only upgrade the advisory names is 3.0.1. Plan the v3 migration now.