diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc index 86072d450..17af25878 100644 --- a/src/site/content/jakarta-ee.adoc +++ b/src/site/content/jakarta-ee.adoc @@ -299,15 +299,25 @@ authc.logoutFallbackType = $fallbackType ---- ==== Automatic form submit upon subsequent login -The module will automatically submit forms upon session expiration and subsequent re-login. -To disable this behavior, add the following to `web.xml`: +Jakarta EE module will automatically resubmit forms when session expires and a subsequent re-login occurs. This will prevent users data from loss due to sessions timing out. + [source,xml] +.To disable this behavior, add the following to `web.xml`: ---- org.apache.shiro.form-resubmit.disabled true ---- +During form resubmissions, the original request is replayed, and the response is relayed back to the browser, along with any cookies genereated. Cookies are set to be secure by default. +[source,xml] +.To disable secure cookie attribute, add the following to `web.xml`: +---- + + org.apache.shiro.form-resubmit.secure-cookies + false + +---- ==== Configuring for Tomcat / Jetty (or without Jakarta Faces) If Jakarta Faces (JSF) is not available in your environment, you need to put the following into your `web.xml` to enable proper OmniFaces initialization: