title: NullPointerException using Shiro
body: <p>I'm adding shiro to an existing Web application(using spring mvc), but I always got NullPointerException. </p>
  
  <p>Here are the error message:</p>
  
  <pre><code>Servlet.service() for servlet [jsp] in context with path [/haha-web] threw exception [Filtered request failed.] with root cause
      java.lang.NullPointerException
          at org.apache.shiro.mgt.SessionsSecurityManager.getSession(SessionsSecurityManager.java:125)
          at org.apache.shiro.mgt.DefaultSecurityManager.resolveContextSession(DefaultSecurityManager.java:456)
          at org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:442)
          at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:338)
          at org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:846)
          at org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:148)
          at org.apache.shiro.web.servlet.AbstractShiroFilter.createSubject(AbstractShiroFilter.java:292)
          at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:359)
          at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
          at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
          at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:936)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1004)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
          at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          at java.lang.Thread.run(Thread.java:745)
  
  org.apache.catalina.core.StandardWrapperValve invoke
  Servlet.service() for servlet [static] in context with path [/haha-web] threw exception [Filtered request failed.] with root cause
      java.lang.NullPointerException
          at org.apache.shiro.mgt.SessionsSecurityManager.getSession(SessionsSecurityManager.java:125)
          at org.apache.shiro.mgt.DefaultSecurityManager.resolveContextSession(DefaultSecurityManager.java:456)
          at org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:442)
          at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:338)
          at org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:846)
          at org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:148)
          at org.apache.shiro.web.servlet.AbstractShiroFilter.createSubject(AbstractShiroFilter.java:292)
          at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:359)
          at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
          at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
          at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:936)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1004)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
          at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          at java.lang.Thread.run(Thread.java:745)
  
  org.apache.catalina.core.StandardWrapperValve invoke
  Servlet.service() for servlet [static] in context with path [/haha-web] threw exception [Filtered request failed.] with root cause
      java.lang.NullPointerException
          at org.apache.shiro.mgt.SessionsSecurityManager.getSession(SessionsSecurityManager.java:125)
          at org.apache.shiro.mgt.DefaultSecurityManager.resolveContextSession(DefaultSecurityManager.java:456)
          at org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:442)
          at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:338)
          at org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:846)
          at org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:148)
          at org.apache.shiro.web.servlet.AbstractShiroFilter.createSubject(AbstractShiroFilter.java:292)
          at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:359)
          at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
          at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
          at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:936)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1004)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
          at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          at java.lang.Thread.run(Thread.java:745)
  </code></pre>
  
  <p>I checked the source code of Shiro, seems the sessionManager is Null.</p>
  
  <p>Here are part of my shiro config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:util="http://www.springframework.org/schema/util"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="
         http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
         http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"&gt;
  
      &lt;bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"&gt;
          &lt;property name="cacheManagerConfigFile" value="classpath:spring/ehcache.xml"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="credentialsMatcher" class="org.haha.security.credentials.RetryLimitHashedCredentialsMatcher"&gt;
          &lt;constructor-arg ref="cacheManager"/&gt;
          &lt;property name="hashAlgorithmName" value="md5"/&gt;
          &lt;property name="hashIterations" value="2"/&gt;
          &lt;property name="storedCredentialsHexEncoded" value="true"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userRealm" class="org.haha.security.realm.UserRealm"&gt;
          &lt;property name="operatorService" ref="operatorService"/&gt;
          &lt;property name="credentialsMatcher" ref="credentialsMatcher"/&gt;
          &lt;property name="cachingEnabled" value="true"/&gt;
          &lt;property name="authenticationCachingEnabled" value="true"/&gt;
          &lt;property name="authenticationCacheName" value="authenticationCache"/&gt;
          &lt;property name="authorizationCachingEnabled" value="true"/&gt;
          &lt;property name="authorizationCacheName" value="authorizationCache"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/&gt;
  
      &lt;bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie"&gt;
          &lt;constructor-arg value="sid"/&gt;
          &lt;property name="httpOnly" value="true"/&gt;
          &lt;property name="maxAge" value="180000"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO"&gt;
          &lt;property name="activeSessionsCacheName" value="shiro-activeSessionCache"/&gt;
          &lt;property name="sessionIdGenerator" ref="sessionIdGenerator"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sessionValidationScheduler" class="org.apache.shiro.session.mgt.quartz.QuartzSessionValidationScheduler"&gt;
          &lt;property name="sessionValidationInterval" value="1800000"/&gt;
          &lt;property name="sessionManager" ref="sessionManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"&gt;
          &lt;property name="globalSessionTimeout" value="1800000"/&gt;
          &lt;property name="deleteInvalidSessions" value="true"/&gt;
          &lt;property name="sessionValidationSchedulerEnabled" value="true"/&gt;
          &lt;property name="sessionValidationScheduler" ref="sessionValidationScheduler"/&gt;
          &lt;property name="sessionDAO" ref="sessionDAO"/&gt;
          &lt;property name="sessionIdCookieEnabled" value="true"/&gt;
          &lt;property name="sessionIdCookie" ref="sessionIdCookie"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"&gt;
          &lt;property name="realm" ref="userRealm"/&gt;
          &lt;property name="sessionManager" ref="sessionManager"/&gt;
          &lt;property name="cacheManager" ref="cacheManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean"&gt;
          &lt;property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/&gt;
          &lt;property name="arguments" ref="securityManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/&gt;
  
      &lt;bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"&gt;
          &lt;property name="securityManager" ref="securityManager"/&gt;
          &lt;property name="loginUrl" value="/home"/&gt;
          &lt;property name="successUrl" value="/home"/&gt;
          &lt;property name="unauthorizedUrl" value="/home"/&gt;
          &lt;property name="filterChainDefinitions"&gt;
              &lt;value&gt;
                  /js/** = anon
                  /api-js/** = anon
                  /img/** = anon
                  /css/** = anon
                  /** = authc
              &lt;/value&gt;
          &lt;/property&gt;         
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>I'm new to Shiro, and I've tried everything I could in the past 4 days T_T, hope someone can help me.</p>