默認是HttpOnly的，即瀏覽器關閉便失效。
如果你想要修改Cookie，那么請參考如下配置
@Bean
def securityManager() {
def securityManager = new DefaultWebSecurityManager()
securityManager.realm = realm()
securityManager.cacheManager = cacheManager()
securityManager.sessionManager = sessionManager()
securityManager.rememberMeManager = rememberMeManager()

return securityManager
}

def sessionManager() {
def sessionManager = new DefaultWebSessionManager()
def cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME)
//cookie.setHttpOnly(true)
cookie.maxAge = 24 * 60 * 60
sessionManager.sessionIdCookie = cookie
return sessionManager
}

def rememberMeManager() {
def rememberMeManager = new CookieRememberMeManager()
def cookie = new SimpleCookie(CookieRememberMeManager.DEFAULT_REMEMBER_ME_COOKIE_NAME)
//cookie.setHttpOnly(true)
//cookie.setMaxAge(Cookie.ONE_YEAR)
cookie.maxAge = 60 * 60 * 24 * 7
rememberMeManager.cookie = cookie
return rememberMeManager
}

ie11下查看cookie：1:IE11=》F12打開開發人員工具2：開發人員工具=》網絡F5啟用網絡流量捕獲3：IE11=》輸入和訪問相關網址4：開發人員工具=》網絡=》詳細信息=》Cookie如果你只在java后臺寫的cookie，前端瀏覽器當然看不到

因為shiro的登錄異常很少，沒有設計自定義，不過你可以通過重寫異常顯示標簽來做到: