Packages 
Package Description
org.apache.shiro.web
Shiro's web support module to support security in any web-enabled application.
org.apache.shiro.web.config
Web-specific implementation extensions to the org.apache.shiro.config components.
org.apache.shiro.web.env
Web-specific Environment implementation and support.
org.apache.shiro.web.filter
Base package supporting all Servlet Filter implementations used to control access to web pages and URL resources.
org.apache.shiro.web.filter.authc
Servlet Filter implementations specific to controlling access based on a subject's authentication status, or those that can execute authentications (log-ins) directly.
org.apache.shiro.web.filter.authz
Servlet Filter implementations that perform authorization (access control) checks based on the Subject's abilities (for example, role or permission checks).
org.apache.shiro.web.filter.mgt
The filter 'mgt' (management) package contains components used in managing Filters that are available for filter chain construction, the filter chains themselves, as well as resolving filter chains based by name.
org.apache.shiro.web.filter.session  
org.apache.shiro.web.mgt
Components supporting web-specific SecurityManager implementations.
org.apache.shiro.web.servlet
Shiro-specific implementations of the Servlet API (Servlet Filters, et al).
org.apache.shiro.web.session
Components supporting Session management in web-enabled applications.
org.apache.shiro.web.session.mgt  
org.apache.shiro.web.subject
Web-specific Subject interfaces to enable Subject use in web environments.
org.apache.shiro.web.subject.support
Supporting implementations of org.apache.shiro.web.subject package interfaces.
org.apache.shiro.web.tags
Provides the Shiro JSP Tag Library implementations.
org.apache.shiro.web.util