public class CookieRememberMeManager extends AbstractRememberMeManager {      ...      /**      * Base64-encodes the specified serialized byte array and sets that base64-encoded String as the cookie value.      * <p/>      * The {@code subject} instance is expected to be a {@link WebSubject} instance with an HTTP Request/Response pair      * so an HTTP cookie can be set on the outgoing response.  If it is not a {@code WebSubject} or that      * {@code WebSubject} does not have an HTTP Request/Response pair, this implementation does nothing.      *      * @param subject    the Subject for which the identity is being serialized.      * @param serialized the serialized bytes to be persisted.      */     protected void rememberSerializedIdentity(Subject subject, byte[] serialized) {          if (!WebUtils.isHttp(subject)) {             if (log.isDebugEnabled()) {                 String msg = "Subject argument is not an HTTP-aware instance.  This is required to obtain a servlet " +                         "request and response in order to set the rememberMe cookie. Returning immediately and " +                         "ignoring rememberMe operation.";                 log.debug(msg);             }             return;         }           HttpServletRequest request = WebUtils.getHttpRequest(subject);         HttpServletResponse response = WebUtils.getHttpResponse(subject);          //base 64 encode it and store as a cookie:         String base64 = Base64.encodeToString(serialized);          Cookie template = getCookie(); //the class attribute is really a template for the outgoing cookies         Cookie cookie = new SimpleCookie(template);         cookie.setValue(base64);         cookie.saveTo(request, response);     }      ...      /**      * Returns a previously serialized identity byte array or {@code null} if the byte array could not be acquired.      * This implementation retrieves an HTTP cookie, Base64-decodes the cookie value, and returns the resulting byte      * array.      * <p/>      * The {@code SubjectContext} instance is expected to be a {@link WebSubjectContext} instance with an HTTP      * Request/Response pair so an HTTP cookie can be retrieved from the incoming request.  If it is not a      * {@code WebSubjectContext} or that {@code WebSubjectContext} does not have an HTTP Request/Response pair, this      * implementation returns {@code null}.      *      * @param subjectContext the contextual data, usually provided by a {@link Subject.Builder} implementation, that      *                       is being used to construct a {@link Subject} instance.  To be used to assist with data      *                       lookup.      * @return a previously serialized identity byte array or {@code null} if the byte array could not be acquired.      */     protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) {          if (!WebUtils.isHttp(subjectContext)) {             if (log.isDebugEnabled()) {                 String msg = "SubjectContext argument is not an HTTP-aware instance.  This is required to obtain a " +                         "servlet request and response in order to retrieve the rememberMe cookie. Returning " +                         "immediately and ignoring rememberMe operation.";                 log.debug(msg);             }             return null;         }          WebSubjectContext wsc = (WebSubjectContext) subjectContext;         if (isIdentityRemoved(wsc)) {             return null;         }          HttpServletRequest request = WebUtils.getHttpRequest(wsc);         HttpServletResponse response = WebUtils.getHttpResponse(wsc);          String base64 = getCookie().readValue(request, response);         // Browsers do not always remove cookies immediately (SHIRO-183)         // ignore cookies that are scheduled for removal         if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null;          if (base64 != null) {             base64 = ensurePadding(base64);             if (log.isTraceEnabled()) {                 log.trace("Acquired Base64 encoded identity [" + base64 + "]");             }             byte[] decoded = Base64.decode(base64);             if (log.isTraceEnabled()) {                 log.trace("Base64 decoded byte array length: " + (decoded != null ? decoded.length : 0) + " bytes.");             }             return decoded;         } else {             //no cookie set - new site visitor?             return null;         }     }

public class DefaultSerializer<T> implements Serializer<T> {      /**      * This implementation serializes the Object by using an {@link ObjectOutputStream} backed by a      * {@link ByteArrayOutputStream}.  The {@code ByteArrayOutputStream}'s backing byte array is returned.      *      * @param o the Object to convert into a byte[] array.      * @return the bytes representing the serialized object using standard JVM serialization.      * @throws SerializationException wrapping a {@link IOException} if something goes wrong with the streams.      */     public byte[] serialize(T o) throws SerializationException {         if (o == null) {             String msg = "argument cannot be null.";             throw new IllegalArgumentException(msg);         }         ByteArrayOutputStream baos = new ByteArrayOutputStream();         BufferedOutputStream bos = new BufferedOutputStream(baos);          try {             ObjectOutputStream oos = new ObjectOutputStream(bos);             oos.writeObject(o);             oos.close();             return baos.toByteArray();         } catch (IOException e) {             String msg = "Unable to serialize object [" + o + "].  " +                     "In order for the DefaultSerializer to serialize this object, the [" + o.getClass().getName() + "] " +                     "class must implement java.io.Serializable.";             throw new SerializationException(msg, e);         }     }      /**      * This implementation deserializes the byte array using a {@link ObjectInputStream} using a source      * {@link ByteArrayInputStream} constructed with the argument byte array.      *      * @param serialized the raw data resulting from a previous {@link #serialize(Object) serialize} call.      * @return the deserialized/reconstituted object based on the given byte array      * @throws SerializationException if anything goes wrong using the streams.      */     public T deserialize(byte[] serialized) throws SerializationException {         if (serialized == null) {             String msg = "argument cannot be null.";             throw new IllegalArgumentException(msg);         }         ByteArrayInputStream bais = new ByteArrayInputStream(serialized);         BufferedInputStream bis = new BufferedInputStream(bais);         try {             ObjectInputStream ois = new ClassResolvingObjectInputStream(bis);             @SuppressWarnings({"unchecked"})             T deserialized = (T) ois.readObject();             ois.close();             return deserialized;         } catch (Exception e) {             String msg = "Unable to deserialze argument byte array.";             throw new SerializationException(msg, e);         }     }}

mvn package