Organize imports

Use "organize imports" from Eclipse to cleanup import statements so
that they appear in a consistent and well defined order.

Issue gh-8945

web/src/main/java/org/springframework/security/web/AuthenticationEntryPoint.java

@@ -16,15 +16,15 @@
 
 package org.springframework.security.web;
 
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.web.access.ExceptionTranslationFilter;
-
 import java.io.IOException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.access.ExceptionTranslationFilter;
+
 /**
  * Used by {@link ExceptionTranslationFilter} to commence an authentication scheme.
  *

web/src/main/java/org/springframework/security/web/DefaultRedirectStrategy.java

@@ -22,6 +22,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.web.util.UrlUtils;
 
 /**

web/src/main/java/org/springframework/security/web/DefaultSecurityFilterChain.java

@@ -15,13 +15,17 @@
  */
 package org.springframework.security.web;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.web.util.matcher.RequestMatcher;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
 
 import javax.servlet.Filter;
 import javax.servlet.http.HttpServletRequest;
-import java.util.*;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.security.web.util.matcher.RequestMatcher;
 
 /**
  * Standard implementation of {@code SecurityFilterChain}.

web/src/main/java/org/springframework/security/web/FilterChainProxy.java

@@ -16,20 +16,10 @@
 
 package org.springframework.security.web;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.firewall.DefaultRequestRejectedHandler;
-import org.springframework.security.web.firewall.FirewalledRequest;
-import org.springframework.security.web.firewall.HttpFirewall;
-import org.springframework.security.web.firewall.RequestRejectedException;
-import org.springframework.security.web.firewall.RequestRejectedHandler;
-import org.springframework.security.web.firewall.StrictHttpFirewall;
-import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.security.web.util.UrlUtils;
-import org.springframework.util.Assert;
-import org.springframework.web.filter.DelegatingFilterProxy;
-import org.springframework.web.filter.GenericFilterBean;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
 
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -38,8 +28,22 @@ import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.util.*;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.firewall.DefaultRequestRejectedHandler;
+import org.springframework.security.web.firewall.FirewalledRequest;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.RequestRejectedException;
+import org.springframework.security.web.firewall.RequestRejectedHandler;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+import org.springframework.security.web.util.UrlUtils;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.util.Assert;
+import org.springframework.web.filter.DelegatingFilterProxy;
+import org.springframework.web.filter.GenericFilterBean;
 
 /**
  * Delegates {@code Filter} requests to a list of Spring-managed filter beans. As of

web/src/main/java/org/springframework/security/web/PortResolverImpl.java

@@ -16,10 +16,10 @@
 
 package org.springframework.security.web;
 
-import org.springframework.util.Assert;
-
 import javax.servlet.ServletRequest;
 
+import org.springframework.util.Assert;
+
 /**
  * Concrete implementation of {@link PortResolver} that obtains the port from
  * <tt>ServletRequest.getServerPort()</tt>.

web/src/main/java/org/springframework/security/web/SecurityFilterChain.java

@@ -15,9 +15,10 @@
  */
 package org.springframework.security.web;
 
+import java.util.List;
+
 import javax.servlet.Filter;
 import javax.servlet.http.HttpServletRequest;
-import java.util.*;
 
 /**
  * Defines a filter chain which is capable of being matched against an

web/src/main/java/org/springframework/security/web/access/AccessDeniedHandler.java

@@ -16,14 +16,14 @@
 
 package org.springframework.security.web.access;
 
-import org.springframework.security.access.AccessDeniedException;
-
 import java.io.IOException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.access.AccessDeniedException;
+
 /**
  * Used by {@link ExceptionTranslationFilter} to handle an
  * <code>AccessDeniedException</code>.

web/src/main/java/org/springframework/security/web/access/AccessDeniedHandlerImpl.java

@@ -25,6 +25,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.http.HttpStatus;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.web.WebAttributes;

web/src/main/java/org/springframework/security/web/access/DefaultWebInvocationPrivilegeEvaluator.java

@@ -20,6 +20,7 @@ import java.util.Collection;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.intercept.AbstractSecurityInterceptor;

web/src/main/java/org/springframework/security/web/access/ExceptionTranslationFilter.java

@@ -15,6 +15,16 @@
  */
 package org.springframework.security.web.access;
 
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
@@ -30,16 +40,6 @@ import org.springframework.security.web.util.ThrowableAnalyzer;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;
 
-import org.springframework.context.support.MessageSourceAccessor;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-
 /**
  * Handles any <code>AccessDeniedException</code> and <code>AuthenticationException</code>
  * thrown within the filter chain.

web/src/main/java/org/springframework/security/web/access/RequestMatcherDelegatingAccessDeniedHandler.java

@@ -18,6 +18,7 @@ package org.springframework.security.web.access;
 import java.io.IOException;
 import java.util.LinkedHashMap;
 import java.util.Map.Entry;
+
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

web/src/main/java/org/springframework/security/web/access/channel/AbstractRetryEntryPoint.java

@@ -15,15 +15,21 @@
  */
 package org.springframework.security.web.access.channel;
 
-import org.springframework.security.web.*;
-import org.springframework.util.Assert;
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
+import org.springframework.security.web.DefaultRedirectStrategy;
+import org.springframework.security.web.PortMapper;
+import org.springframework.security.web.PortMapperImpl;
+import org.springframework.security.web.PortResolver;
+import org.springframework.security.web.PortResolverImpl;
+import org.springframework.security.web.RedirectStrategy;
+import org.springframework.util.Assert;
 
 /**
  * @author Luke Taylor

web/src/main/java/org/springframework/security/web/access/channel/ChannelDecisionManager.java

@@ -16,14 +16,14 @@
 
 package org.springframework.security.web.access.channel;
 
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.web.FilterInvocation;
-
 import java.io.IOException;
 import java.util.Collection;
 
 import javax.servlet.ServletException;
 
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.web.FilterInvocation;
+
 /**
  * Decides whether a web channel provides sufficient security.
  *

web/src/main/java/org/springframework/security/web/access/channel/ChannelDecisionManagerImpl.java

@@ -16,20 +16,18 @@
 
 package org.springframework.security.web.access.channel;
 
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.web.FilterInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.util.Assert;
-
 import java.io.IOException;
-
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
 import javax.servlet.ServletException;
 
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.web.FilterInvocation;
+import org.springframework.util.Assert;
+
 /**
  * Implementation of {@link ChannelDecisionManager}.
  * <p>

web/src/main/java/org/springframework/security/web/access/channel/ChannelEntryPoint.java

@@ -17,6 +17,7 @@
 package org.springframework.security.web.access.channel;
 
 import java.io.IOException;
+
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

web/src/main/java/org/springframework/security/web/access/channel/ChannelProcessor.java

@@ -16,14 +16,14 @@
 
 package org.springframework.security.web.access.channel;
 
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.web.FilterInvocation;
-
 import java.io.IOException;
 import java.util.Collection;
 
 import javax.servlet.ServletException;
 
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.web.FilterInvocation;
+
 /**
  * Decides whether a web channel meets a specific security condition.
  * <p>

web/src/main/java/org/springframework/security/web/access/intercept/DefaultFilterInvocationSecurityMetadataSource.java

@@ -26,6 +26,7 @@ import javax.servlet.http.HttpServletRequest;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.util.matcher.RequestMatcher;

web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandler.java

@@ -16,6 +16,7 @@
 package org.springframework.security.web.authentication;
 
 import java.io.IOException;
+
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

web/src/main/java/org/springframework/security/web/authentication/AnonymousAuthenticationFilter.java

@@ -17,7 +17,7 @@
 package org.springframework.security.web.authentication;
 
 import java.io.IOException;
-import java.util.*;
+import java.util.List;
 
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;

web/src/main/java/org/springframework/security/web/authentication/AuthenticationFilter.java

@@ -16,6 +16,7 @@
 package org.springframework.security.web.authentication;
 
 import java.io.IOException;
+
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;

web/src/main/java/org/springframework/security/web/authentication/DelegatingAuthenticationEntryPoint.java

@@ -24,6 +24,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;

web/src/main/java/org/springframework/security/web/authentication/DelegatingAuthenticationFailureHandler.java

@@ -15,15 +15,16 @@
  */
 package org.springframework.security.web.authentication;
 
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.util.Assert;
+import java.io.IOException;
+import java.util.LinkedHashMap;
+import java.util.Map;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.util.LinkedHashMap;
-import java.util.Map;
+
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.util.Assert;
 
 /**
  * An {@link AuthenticationFailureHandler} that delegates to other

web/src/main/java/org/springframework/security/web/authentication/ForwardAuthenticationFailureHandler.java

@@ -15,15 +15,16 @@
  */
 package org.springframework.security.web.authentication;
 
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.web.WebAttributes;
-import org.springframework.security.web.util.UrlUtils;
-import org.springframework.util.Assert;
+import java.io.IOException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
+
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.WebAttributes;
+import org.springframework.security.web.util.UrlUtils;
+import org.springframework.util.Assert;
 
 /**
  * <p>

web/src/main/java/org/springframework/security/web/authentication/ForwardAuthenticationSuccessHandler.java

@@ -15,14 +15,15 @@
  */
 package org.springframework.security.web.authentication;
 
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.util.UrlUtils;
-import org.springframework.util.Assert;
+import java.io.IOException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.util.UrlUtils;
+import org.springframework.util.Assert;
 
 /**
  * <p>

web/src/main/java/org/springframework/security/web/authentication/Http403ForbiddenEntryPoint.java

@@ -22,6 +22,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 

web/src/main/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPoint.java

@@ -25,6 +25,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;

web/src/main/java/org/springframework/security/web/authentication/NullRememberMeServices.java

@@ -16,11 +16,11 @@
 
 package org.springframework.security.web.authentication;
 
-import org.springframework.security.core.Authentication;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.core.Authentication;
+
 /**
  * Implementation of {@link NullRememberMeServices} that does nothing.
  * <p>

web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java

@@ -23,12 +23,13 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.access.ExceptionTranslationFilter;
-import org.springframework.util.StringUtils;
-import org.springframework.security.web.savedrequest.SavedRequest;
-import org.springframework.security.web.savedrequest.RequestCache;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+import org.springframework.security.web.savedrequest.RequestCache;
+import org.springframework.security.web.savedrequest.SavedRequest;
+import org.springframework.util.StringUtils;
 
 /**
  * An authentication success strategy which can make use of the

web/src/main/java/org/springframework/security/web/authentication/SimpleUrlAuthenticationFailureHandler.java

@@ -24,11 +24,12 @@ import javax.servlet.http.HttpSession;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.DefaultRedirectStrategy;
 import org.springframework.security.web.RedirectStrategy;
+import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
 

web/src/main/java/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilter.java

@@ -16,6 +16,9 @@
 
 package org.springframework.security.web.authentication;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationServiceException;
@@ -25,9 +28,6 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.util.Assert;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
 /**
  * Processes an authentication form submission. Called
  * {@code AuthenticationProcessingFilter} prior to Spring Security 3.0.

web/src/main/java/org/springframework/security/web/authentication/WebAuthenticationDetails.java

@@ -16,12 +16,13 @@
 
 package org.springframework.security.web.authentication;
 
-import org.springframework.security.core.SpringSecurityCoreVersion;
-
 import java.io.Serializable;
+
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
+import org.springframework.security.core.SpringSecurityCoreVersion;
+
 /**
  * A holder of selected HTTP details related to a web authentication request.
  *

web/src/main/java/org/springframework/security/web/authentication/WebAuthenticationDetailsSource.java

@@ -16,10 +16,10 @@
 
 package org.springframework.security.web.authentication;
 
-import org.springframework.security.authentication.AuthenticationDetailsSource;
-
 import javax.servlet.http.HttpServletRequest;
 
+import org.springframework.security.authentication.AuthenticationDetailsSource;
+
 /**
  * Implementation of {@link AuthenticationDetailsSource} which builds the details object
  * from an <tt>HttpServletRequest</tt> object, creating a {@code WebAuthenticationDetails}

web/src/main/java/org/springframework/security/web/authentication/logout/CookieClearingLogoutHandler.java

@@ -15,7 +15,8 @@
  */
 package org.springframework.security.web.authentication.logout;
 
-import java.util.*;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.function.Function;
 
 import javax.servlet.http.Cookie;

web/src/main/java/org/springframework/security/web/authentication/logout/LogoutFilter.java

@@ -27,9 +27,9 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.util.UrlUtils;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 import org.springframework.web.filter.GenericFilterBean;

web/src/main/java/org/springframework/security/web/authentication/logout/LogoutHandler.java

@@ -16,11 +16,11 @@
 
 package org.springframework.security.web.authentication.logout;
 
-import org.springframework.security.core.Authentication;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.core.Authentication;
+
 /**
  * Indicates a class that is able to participate in logout handling.
  *

web/src/main/java/org/springframework/security/web/authentication/logout/LogoutSuccessEventPublishingLogoutHandler.java

@@ -18,6 +18,7 @@ package org.springframework.security.web.authentication.logout;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.ApplicationEventPublisherAware;
 import org.springframework.security.authentication.event.LogoutSuccessEvent;

web/src/main/java/org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.java

@@ -22,6 +22,7 @@ import javax.servlet.http.HttpSession;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;

web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java

@@ -16,6 +16,7 @@
 package org.springframework.security.web.authentication.preauth;
 
 import java.io.IOException;
+
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
@@ -33,7 +34,9 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.WebAttributes;
-import org.springframework.security.web.authentication.*;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationProvider.java

@@ -17,6 +17,7 @@ package org.springframework.security.web.authentication.preauth;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.core.Ordered;
 import org.springframework.security.authentication.AccountStatusUserDetailsChecker;

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java

@@ -15,7 +15,7 @@
  */
 package org.springframework.security.web.authentication.preauth;
 
-import java.util.*;
+import java.util.Collection;
 
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
@@ -24,7 +24,6 @@ import org.springframework.security.core.authority.GrantedAuthoritiesContainer;
 import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
-
 import org.springframework.util.Assert;
 
 /**

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails.java

@@ -15,14 +15,18 @@
  */
 package org.springframework.security.web.authentication.preauth;
 
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.SpringSecurityCoreVersion;
 import org.springframework.security.core.authority.GrantedAuthoritiesContainer;
 import org.springframework.security.web.authentication.WebAuthenticationDetails;
 
-import javax.servlet.http.HttpServletRequest;
-import java.util.*;
-
 /**
  * This WebAuthenticationDetails implementation allows for storing a list of
  * pre-authenticated Granted Authorities.

web/src/main/java/org/springframework/security/web/authentication/preauth/j2ee/J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource.java

@@ -15,8 +15,16 @@
  */
 package org.springframework.security.web.authentication.preauth.j2ee;
 
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
+
+import javax.servlet.http.HttpServletRequest;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.core.GrantedAuthority;
@@ -26,9 +34,6 @@ import org.springframework.security.core.authority.mapping.SimpleAttributes2Gran
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;
 import org.springframework.util.Assert;
 
-import javax.servlet.http.HttpServletRequest;
-import java.util.*;
-
 /**
  * Implementation of AuthenticationDetailsSource which converts the user's J2EE roles (as
  * obtained by calling {@link HttpServletRequest#isUserInRole(String)}) into

web/src/main/java/org/springframework/security/web/authentication/preauth/j2ee/WebXmlMappableAttributesRetriever.java

@@ -30,11 +30,6 @@ import javax.xml.parsers.ParserConfigurationException;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.context.ResourceLoaderAware;
-import org.springframework.core.io.Resource;
-import org.springframework.core.io.ResourceLoader;
-import org.springframework.security.core.authority.mapping.MappableAttributesRetriever;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
@@ -42,6 +37,12 @@ import org.xml.sax.EntityResolver;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.context.ResourceLoaderAware;
+import org.springframework.core.io.Resource;
+import org.springframework.core.io.ResourceLoader;
+import org.springframework.security.core.authority.mapping.MappableAttributesRetriever;
+
 /**
  * This <tt>MappableAttributesRetriever</tt> implementation reads the list of defined J2EE
  * roles from a <tt>web.xml</tt> file and returns these from {

web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/WebSpherePreAuthenticatedWebAuthenticationDetailsSource.java

@@ -15,17 +15,20 @@
  */
 package org.springframework.security.web.authentication.preauth.websphere;
 
+import java.util.Collection;
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.mapping.Attributes2GrantedAuthoritiesMapper;
 import org.springframework.security.core.authority.mapping.SimpleAttributes2GrantedAuthoritiesMapper;
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;
 
-import javax.servlet.http.HttpServletRequest;
-import java.util.*;
-
 /**
  * This AuthenticationDetailsSource implementation will set the pre-authenticated granted
  * authorities based on the WebSphere groups for the current WebSphere user, mapped using

web/src/main/java/org/springframework/security/web/authentication/preauth/x509/SubjectDnX509PrincipalExtractor.java

@@ -15,18 +15,18 @@
  */
 package org.springframework.security.web.authentication.preauth.x509;
 
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.core.SpringSecurityMessageSource;
-import org.springframework.util.Assert;
-import org.springframework.context.support.MessageSourceAccessor;
-import org.springframework.context.MessageSource;
+import java.security.cert.X509Certificate;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import java.security.cert.X509Certificate;
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
+import org.springframework.context.MessageSource;
+import org.springframework.context.support.MessageSourceAccessor;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.core.SpringSecurityMessageSource;
+import org.springframework.util.Assert;
 
 /**
  * Obtains the principal from a certificate using a regular expression match against the

web/src/main/java/org/springframework/security/web/authentication/rememberme/AbstractRememberMeServices.java

@@ -16,10 +16,10 @@
 package org.springframework.security.web.authentication.rememberme;
 
 import java.io.UnsupportedEncodingException;
-import java.util.Base64;
 import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
@@ -27,6 +27,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.authentication.AccountStatusException;

web/src/main/java/org/springframework/security/web/authentication/rememberme/InMemoryTokenRepositoryImpl.java

@@ -15,13 +15,13 @@
  */
 package org.springframework.security.web.authentication.rememberme;
 
-import org.springframework.dao.DataIntegrityViolationException;
-
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
 
+import org.springframework.dao.DataIntegrityViolationException;
+
 /**
  * Simple <tt>PersistentTokenRepository</tt> implementation backed by a Map. Intended for
  * testing only.

web/src/main/java/org/springframework/security/web/authentication/rememberme/JdbcTokenRepositoryImpl.java

@@ -15,13 +15,13 @@
  */
 package org.springframework.security.web.authentication.rememberme;
 
+import java.util.Date;
+
 import org.springframework.dao.DataAccessException;
 import org.springframework.dao.EmptyResultDataAccessException;
 import org.springframework.dao.IncorrectResultSizeDataAccessException;
 import org.springframework.jdbc.core.support.JdbcDaoSupport;
 
-import java.util.*;
-
 /**
  * JDBC based persistent login token repository implementation.
  *

web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java

@@ -24,8 +24,8 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.security.core.Authentication;
-import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.web.authentication.RememberMeServices;
 import org.springframework.util.Assert;
 

web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java

@@ -16,22 +16,22 @@
 
 package org.springframework.security.web.authentication.rememberme;
 
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.crypto.codec.Hex;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.crypto.codec.Utf8;
-import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 import java.util.Date;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.codec.Hex;
+import org.springframework.security.crypto.codec.Utf8;
+import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
+
 /**
  * Identifies previously remembered users by a Base-64 encoded cookie.
  *

web/src/main/java/org/springframework/security/web/authentication/session/AbstractSessionFixationProtectionStrategy.java

@@ -21,6 +21,7 @@ import javax.servlet.http.HttpSession;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.context.ApplicationEvent;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.ApplicationEventPublisherAware;

web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java

@@ -15,6 +15,20 @@
  */
 package org.springframework.security.web.authentication.ui;
 
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+import java.util.Map;
+import java.util.function.Function;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
@@ -24,19 +38,6 @@ import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;
 import org.springframework.web.util.HtmlUtils;
 
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Collections;
-import java.util.Map;
-import java.util.function.Function;
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-
 /**
  * For internal use with namespace configuration in the case where a user doesn't
  * configure a login page. The configuration code will insert this filter in the chain

web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java

@@ -16,19 +16,20 @@
 
 package org.springframework.security.web.authentication.ui;
 
-import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
-import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.util.Assert;
-import org.springframework.web.filter.OncePerRequestFilter;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.Map;
+import java.util.function.Function;
 
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.util.Collections;
-import java.util.Map;
-import java.util.function.Function;
+
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.util.Assert;
+import org.springframework.web.filter.OncePerRequestFilter;
 
 /**
  * Generates a default log out page.

web/src/main/java/org/springframework/security/web/authentication/www/BasicAuthenticationConverter.java

@@ -15,8 +15,6 @@
  */
 package org.springframework.security.web.authentication.www;
 
-import static org.springframework.http.HttpHeaders.AUTHORIZATION;
-
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
@@ -31,6 +29,8 @@ import org.springframework.security.web.authentication.WebAuthenticationDetailsS
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
+import static org.springframework.http.HttpHeaders.AUTHORIZATION;
+
 /**
  * Converts from a HttpServletRequest to {@link UsernamePasswordAuthenticationToken} that
  * can be authenticated. Null authentication possible if there was no Authorization header

web/src/main/java/org/springframework/security/web/authentication/www/BasicAuthenticationEntryPoint.java

@@ -21,10 +21,10 @@ import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.beans.factory.InitializingBean;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
-import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;
 
 /**

web/src/main/java/org/springframework/security/web/authentication/www/DigestAuthenticationEntryPoint.java

@@ -24,6 +24,7 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.core.Ordered;
 import org.springframework.http.HttpStatus;

web/src/main/java/org/springframework/security/web/context/support/SecurityWebApplicationContextUtils.java

@@ -16,6 +16,7 @@
 package org.springframework.security.web.context.support;
 
 import java.util.Enumeration;
+
 import javax.servlet.ServletContext;
 
 import org.springframework.web.context.WebApplicationContext;

web/src/main/java/org/springframework/security/web/debug/DebugFilter.java

@@ -15,9 +15,9 @@
  */
 package org.springframework.security.web.debug;
 
-import org.springframework.security.web.FilterChainProxy;
-import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.util.UrlUtils;
+import java.io.IOException;
+import java.util.Enumeration;
+import java.util.List;
 
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -29,8 +29,10 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
-import java.io.IOException;
-import java.util.*;
+
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.util.UrlUtils;
 
 /**
  * Spring Security debugging filter.

web/src/main/java/org/springframework/security/web/firewall/RequestWrapper.java

@@ -15,15 +15,15 @@
  */
 package org.springframework.security.web.firewall;
 
+import java.io.IOException;
+import java.util.StringTokenizer;
+
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 
-import java.io.IOException;
-import java.util.*;
-
 /**
  * Request wrapper which ensures values of {@code servletPath} and {@code pathInfo} are
  * returned which are suitable for pattern matching against. It strips out path parameters

web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java

@@ -26,6 +26,7 @@ import java.util.Map;
 import java.util.Set;
 import java.util.function.Predicate;
 import java.util.regex.Pattern;
+
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 

web/src/main/java/org/springframework/security/web/header/writers/CompositeHeaderWriter.java

@@ -15,12 +15,13 @@
  */
 package org.springframework.security.web.header.writers;
 
-import org.springframework.security.web.header.HeaderWriter;
-import org.springframework.util.Assert;
+import java.util.List;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.util.List;
+
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.util.Assert;
 
 /**
  * A {@link HeaderWriter} that delegates to several other {@link HeaderWriter}s.

web/src/main/java/org/springframework/security/web/header/writers/ContentSecurityPolicyHeaderWriter.java

@@ -15,12 +15,12 @@
  */
 package org.springframework.security.web.header.writers;
 
-import org.springframework.security.web.header.HeaderWriter;
-import org.springframework.util.Assert;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.util.Assert;
+
 /**
  * <p>
  * Provides support for <a href="https://www.w3.org/TR/CSP2/">Content Security Policy

web/src/main/java/org/springframework/security/web/header/writers/HpkpHeaderWriter.java

@@ -15,19 +15,21 @@
  */
 package org.springframework.security.web.header.writers;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.web.header.HeaderWriter;
-import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.util.Assert;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.LinkedHashMap;
 import java.util.Map;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.util.Assert;
+
 /**
  * Provides support for <a href="https://tools.ietf.org/html/rfc7469">HTTP Public Key
  * Pinning (HPKP)</a>.

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/AbstractRequestParameterAllowFromStrategy.java

@@ -15,13 +15,14 @@
  */
 package org.springframework.security.web.header.writers.frameoptions;
 
+import javax.servlet.http.HttpServletRequest;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
-import javax.servlet.http.HttpServletRequest;
-
 /**
  * Base class for AllowFromStrategy implementations which use a request parameter to
  * retrieve the origin. By default the parameter named <code>x-frames-allow-from</code> is

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/RegExpAllowFromStrategy.java

@@ -15,10 +15,10 @@
  */
 package org.springframework.security.web.header.writers.frameoptions;
 
-import org.springframework.util.Assert;
-
 import java.util.regex.Pattern;
 
+import org.springframework.util.Assert;
+
 /**
  * Implementation which uses a regular expression to validate the supplied origin. If the
  * value of the HTTP parameter matches the pattern, then the result will be ALLOW-FROM

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/StaticAllowFromStrategy.java

@@ -15,9 +15,10 @@
  */
 package org.springframework.security.web.header.writers.frameoptions;
 
-import javax.servlet.http.HttpServletRequest;
 import java.net.URI;
 
+import javax.servlet.http.HttpServletRequest;
+
 /**
  * Simple implementation of the {@code AllowFromStrategy}
  *

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/XFrameOptionsHeaderWriter.java

@@ -15,12 +15,12 @@
  */
 package org.springframework.security.web.header.writers.frameoptions;
 
-import org.springframework.security.web.header.HeaderWriter;
-import org.springframework.util.Assert;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.util.Assert;
+
 /**
  * {@code HeaderWriter} implementation for the X-Frame-Options headers. When using the
  * ALLOW-FROM directive the actual value is determined by a {@code AllowFromStrategy}.

web/src/main/java/org/springframework/security/web/http/SecurityHeaders.java

@@ -16,11 +16,11 @@
 
 package org.springframework.security.web.http;
 
+import java.util.function.Consumer;
+
 import org.springframework.http.HttpHeaders;
 import org.springframework.util.Assert;
 
-import java.util.function.Consumer;
-
 /**
  * Utilities for interacting with {@link HttpHeaders}
  *

web/src/main/java/org/springframework/security/web/jackson2/CookieDeserializer.java

@@ -16,6 +16,10 @@
 
 package org.springframework.security.web.jackson2;
 
+import java.io.IOException;
+
+import javax.servlet.http.Cookie;
+
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.DeserializationContext;
@@ -25,9 +29,6 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.MissingNode;
 import com.fasterxml.jackson.databind.node.NullNode;
 
-import javax.servlet.http.Cookie;
-import java.io.IOException;
-
 /**
  * Jackson deserializer for {@link Cookie}. This is needed because in most cases we don't
  * set {@link Cookie#getDomain()} property. So when jackson deserialize that json

web/src/main/java/org/springframework/security/web/jackson2/DefaultSavedRequestMixin.java

@@ -19,6 +19,7 @@ package org.springframework.security.web.jackson2;
 import com.fasterxml.jackson.annotation.JsonAutoDetect;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+
 import org.springframework.security.web.savedrequest.DefaultSavedRequest;
 
 /**

web/src/main/java/org/springframework/security/web/jackson2/PreAuthenticatedAuthenticationTokenDeserializer.java

@@ -19,9 +19,6 @@ package org.springframework.security.web.jackson2;
 import java.io.IOException;
 import java.util.List;
 
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
-
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.core.type.TypeReference;
@@ -31,6 +28,9 @@ import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.MissingNode;
 
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
+
 /**
  * Custom deserializer for {@link PreAuthenticatedAuthenticationToken}. At the time of
  * deserialization it will invoke suitable constructor depending on the value of

web/src/main/java/org/springframework/security/web/jackson2/PreAuthenticatedAuthenticationTokenMixin.java

@@ -16,13 +16,13 @@
 
 package org.springframework.security.web.jackson2;
 
-import org.springframework.security.jackson2.SecurityJackson2Modules;
-import org.springframework.security.jackson2.SimpleGrantedAuthorityMixin;
-
 import com.fasterxml.jackson.annotation.JsonAutoDetect;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
 
+import org.springframework.security.jackson2.SecurityJackson2Modules;
+import org.springframework.security.jackson2.SimpleGrantedAuthorityMixin;
+
 /**
  * This mixin class is used to serialize / deserialize
  * {@link org.springframework.security.authentication.UsernamePasswordAuthenticationToken}.

web/src/main/java/org/springframework/security/web/jackson2/SavedCookieMixin.java

@@ -16,7 +16,11 @@
 
 package org.springframework.security.web.jackson2;
 
-import com.fasterxml.jackson.annotation.*;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
 
 /**
  * Jackson mixin class to serialize/deserialize

web/src/main/java/org/springframework/security/web/jackson2/WebAuthenticationDetailsMixin.java

@@ -16,7 +16,11 @@
 
 package org.springframework.security.web.jackson2;
 
-import com.fasterxml.jackson.annotation.*;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
 
 /**
  * Jackson mixin class to serialize/deserialize

web/src/main/java/org/springframework/security/web/jackson2/WebJackson2Module.java

@@ -16,13 +16,13 @@
 
 package org.springframework.security.web.jackson2;
 
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+
 import org.springframework.security.jackson2.SecurityJackson2Modules;
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
 import org.springframework.security.web.csrf.DefaultCsrfToken;
 
-import com.fasterxml.jackson.core.Version;
-import com.fasterxml.jackson.databind.module.SimpleModule;
-
 /**
  * Jackson module for spring-security-web. This module register
  * {@link DefaultCsrfTokenMixin} and {@link PreAuthenticatedAuthenticationTokenMixin}. If

web/src/main/java/org/springframework/security/web/jackson2/WebServletJackson2Module.java

@@ -18,14 +18,14 @@ package org.springframework.security.web.jackson2;
 
 import javax.servlet.http.Cookie;
 
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+
 import org.springframework.security.jackson2.SecurityJackson2Modules;
 import org.springframework.security.web.authentication.WebAuthenticationDetails;
 import org.springframework.security.web.savedrequest.DefaultSavedRequest;
 import org.springframework.security.web.savedrequest.SavedCookie;
 
-import com.fasterxml.jackson.core.Version;
-import com.fasterxml.jackson.databind.module.SimpleModule;
-
 /**
  * Jackson module for spring-security-web related to servlet. This module register
  * {@link CookieMixin}, {@link SavedCookieMixin}, {@link DefaultSavedRequestMixin} and

web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/AuthenticationPrincipalArgumentResolver.java

@@ -18,6 +18,8 @@ package org.springframework.security.web.reactive.result.method.annotation;
 import java.lang.annotation.Annotation;
 
 import org.reactivestreams.Publisher;
+import reactor.core.publisher.Mono;
+
 import org.springframework.core.MethodParameter;
 import org.springframework.core.ReactiveAdapter;
 import org.springframework.core.ReactiveAdapterRegistry;
@@ -36,8 +38,6 @@ import org.springframework.web.reactive.BindingContext;
 import org.springframework.web.reactive.result.method.HandlerMethodArgumentResolverSupport;
 import org.springframework.web.server.ServerWebExchange;
 
-import reactor.core.publisher.Mono;
-
 /**
  * Resolves the Authentication
  *

web/src/main/java/org/springframework/security/web/reactive/result/view/CsrfRequestDataValueProcessor.java

@@ -16,15 +16,15 @@
 
 package org.springframework.security.web.reactive.result.view;
 
+import java.util.Collections;
+import java.util.Map;
+import java.util.regex.Pattern;
+
 import org.springframework.lang.NonNull;
 import org.springframework.security.web.server.csrf.CsrfToken;
 import org.springframework.web.reactive.result.view.RequestDataValueProcessor;
 import org.springframework.web.server.ServerWebExchange;
 
-import java.util.Collections;
-import java.util.Map;
-import java.util.regex.Pattern;
-
 /**
  * @author Rob Winch
  * @since 5.0

web/src/main/java/org/springframework/security/web/savedrequest/CookieRequestCache.java

@@ -15,8 +15,16 @@
  */
 package org.springframework.security.web.savedrequest;
 
+import java.util.Base64;
+import java.util.HashMap;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -27,12 +35,6 @@ import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
 import org.springframework.web.util.WebUtils;
 
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.util.Base64;
-import java.util.HashMap;
-
 /**
  * An Implementation of {@code RequestCache} which saves the original request URI in a
  * cookie.

web/src/main/java/org/springframework/security/web/savedrequest/DefaultSavedRequest.java

@@ -16,19 +16,28 @@
 
 package org.springframework.security.web.savedrequest;
 
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeMap;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.web.PortResolver;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.ObjectUtils;
 
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import java.util.*;
-
 /**
  * Represents central information from a {@code HttpServletRequest}.
  * <p>

web/src/main/java/org/springframework/security/web/savedrequest/FastHttpDateFormat.java

@@ -19,7 +19,6 @@ package org.springframework.security.web.savedrequest;
 import java.text.DateFormat;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
-
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Locale;

web/src/main/java/org/springframework/security/web/savedrequest/HttpSessionRequestCache.java

@@ -21,6 +21,7 @@ import javax.servlet.http.HttpSession;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+
 import org.springframework.security.web.PortResolver;
 import org.springframework.security.web.PortResolverImpl;
 import org.springframework.security.web.util.UrlUtils;

web/src/main/java/org/springframework/security/web/savedrequest/SavedCookie.java

@@ -15,9 +15,10 @@
  */
 package org.springframework.security.web.savedrequest;
 
-import javax.servlet.http.Cookie;
 import java.io.Serializable;
 
+import javax.servlet.http.Cookie;
+
 /**
  * Stores off the values of a cookie in a serializable holder
  *

web/src/main/java/org/springframework/security/web/savedrequest/SimpleSavedRequest.java

@@ -15,9 +15,6 @@
  */
 package org.springframework.security.web.savedrequest;
 
-import org.springframework.util.Assert;
-
-import javax.servlet.http.Cookie;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
@@ -25,6 +22,10 @@ import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 
+import javax.servlet.http.Cookie;
+
+import org.springframework.util.Assert;
+
 /**
  * A Bean implementation of SavedRequest
  *

web/src/main/java/org/springframework/security/web/server/DefaultServerRedirectStrategy.java

@@ -16,15 +16,16 @@
 
 package org.springframework.security.web.server;
 
+import java.net.URI;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import reactor.core.publisher.Mono;
+
 import org.springframework.http.HttpStatus;
 import org.springframework.http.server.reactive.ServerHttpResponse;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-import java.net.URI;
 
 /**
  * The default {@link ServerRedirectStrategy} to use.

web/src/main/java/org/springframework/security/web/server/DelegatingServerAuthenticationEntryPoint.java

@@ -16,20 +16,20 @@
 
 package org.springframework.security.web.server;
 
+import java.util.Arrays;
+import java.util.List;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.springframework.http.HttpStatus;
-import org.springframework.util.Assert;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 
+import org.springframework.http.HttpStatus;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
 
-import java.util.Arrays;
-import java.util.List;
-
 /**
  * A {@link ServerAuthenticationEntryPoint} which delegates to multiple
  * {@link ServerAuthenticationEntryPoint} based on a {@link ServerWebExchangeMatcher}

web/src/main/java/org/springframework/security/web/server/MatcherSecurityWebFilterChain.java

@@ -16,14 +16,15 @@
 
 package org.springframework.security.web.server;
 
+import java.util.List;
+
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.server.WebFilter;
-import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
-
-import java.util.List;
 
 /**
  * A {@link SecurityWebFilterChain} that leverages a {@link ServerWebExchangeMatcher} to

web/src/main/java/org/springframework/security/web/server/SecurityWebFilterChain.java

@@ -16,11 +16,12 @@
 
 package org.springframework.security.web.server;
 
-import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.WebFilter;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+
 /**
  * Defines a filter chain which is capable of being matched against a
  * {@link ServerWebExchange} in order to decide whether it applies to that request.

web/src/main/java/org/springframework/security/web/server/ServerFormLoginAuthenticationConverter.java

@@ -15,16 +15,16 @@
  */
 package org.springframework.security.web.server;
 
-import org.springframework.util.Assert;
+import java.util.function.Function;
+
 import reactor.core.publisher.Mono;
 
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
+import org.springframework.util.Assert;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.server.ServerWebExchange;
 
-import java.util.function.Function;
-
 /**
  * Converts a ServerWebExchange into a UsernamePasswordAuthenticationToken from the form
  * data HTTP parameters.

web/src/main/java/org/springframework/security/web/server/ServerHttpBasicAuthenticationConverter.java

@@ -18,6 +18,8 @@ package org.springframework.security.web.server;
 import java.util.Base64;
 import java.util.function.Function;
 
+import reactor.core.publisher.Mono;
+
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -25,8 +27,6 @@ import org.springframework.security.core.Authentication;
 import org.springframework.util.StringUtils;
 import org.springframework.web.server.ServerWebExchange;
 
-import reactor.core.publisher.Mono;
-
 /**
  * Converts from a {@link ServerWebExchange} to an {@link Authentication} that can be
  * authenticated.

web/src/main/java/org/springframework/security/web/server/WebFilterChainProxy.java

@@ -18,14 +18,14 @@ package org.springframework.security.web.server;
 import java.util.Arrays;
 import java.util.List;
 
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
-
 import org.springframework.web.server.handler.DefaultWebFilterChain;
 import org.springframework.web.server.handler.FilteringWebHandler;
-import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
 
 /**
  * Used to delegate to a List of {@link SecurityWebFilterChain} instances.

web/src/main/java/org/springframework/security/web/server/authentication/AuthenticationConverterServerWebExchangeMatcher.java

@@ -16,15 +16,15 @@
 
 package org.springframework.security.web.server.authentication;
 
-import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult.match;
-import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult.notMatch;
+import reactor.core.publisher.Mono;
 
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
 
-import reactor.core.publisher.Mono;
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult.match;
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult.notMatch;
 
 /**
  * Matches if the {@link ServerAuthenticationConverter} can convert a

web/src/main/java/org/springframework/security/web/server/authentication/DelegatingServerAuthenticationSuccessHandler.java

@@ -16,14 +16,15 @@
 
 package org.springframework.security.web.server.authentication;
 
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.server.WebFilterExchange;
-import org.springframework.util.Assert;
+import java.util.Arrays;
+import java.util.List;
+
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 
-import java.util.Arrays;
-import java.util.List;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.server.WebFilterExchange;
+import org.springframework.util.Assert;
 
 /**
  * Delegates to a collection of {@link ServerAuthenticationSuccessHandler}

web/src/main/java/org/springframework/security/web/server/authentication/HttpBasicServerAuthenticationEntryPoint.java

@@ -15,6 +15,8 @@
  */
 package org.springframework.security.web.server.authentication;
 
+import reactor.core.publisher.Mono;
+
 import org.springframework.http.HttpStatus;
 import org.springframework.http.server.reactive.ServerHttpResponse;
 import org.springframework.security.core.AuthenticationException;
@@ -22,8 +24,6 @@ import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
 
-import reactor.core.publisher.Mono;
-
 /**
  * Prompts a user for HTTP Basic authentication.
  *

web/src/main/java/org/springframework/security/web/server/authentication/HttpStatusServerEntryPoint.java

@@ -16,14 +16,14 @@
 
 package org.springframework.security.web.server.authentication;
 
+import reactor.core.publisher.Mono;
+
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
 
-import reactor.core.publisher.Mono;
-
 /**
  * A {@link ServerAuthenticationEntryPoint} that sends a generic {@link HttpStatus} as a
  * response. Useful for JavaScript clients which cannot use Basic authentication since the

web/src/main/java/org/springframework/security/web/server/authentication/ReactivePreAuthenticatedAuthenticationManager.java

@@ -15,6 +15,8 @@
  */
 package org.springframework.security.web.server.authentication;
 
+import reactor.core.publisher.Mono;
+
 import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
 import org.springframework.security.authentication.ReactiveAuthenticationManager;
 import org.springframework.security.core.Authentication;
@@ -22,7 +24,6 @@ import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.core.userdetails.UserDetailsChecker;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
-import reactor.core.publisher.Mono;
 
 /**
  * Reactive version of

web/src/main/java/org/springframework/security/web/server/authentication/RedirectServerAuthenticationEntryPoint.java

@@ -18,14 +18,14 @@ package org.springframework.security.web.server.authentication;
 
 import java.net.URI;
 
-import org.springframework.security.web.server.DefaultServerRedirectStrategy;
-import org.springframework.security.web.server.ServerRedirectStrategy;
-import org.springframework.security.web.server.savedrequest.ServerRequestCache;
-import org.springframework.security.web.server.savedrequest.WebSessionServerRequestCache;
 import reactor.core.publisher.Mono;
 
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.server.DefaultServerRedirectStrategy;
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.ServerRedirectStrategy;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
+import org.springframework.security.web.server.savedrequest.WebSessionServerRequestCache;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
 

web/src/main/java/org/springframework/security/web/server/authentication/RedirectServerAuthenticationFailureHandler.java

@@ -16,14 +16,15 @@
 
 package org.springframework.security.web.server.authentication;
 
+import java.net.URI;
+
+import reactor.core.publisher.Mono;
+
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.server.DefaultServerRedirectStrategy;
 import org.springframework.security.web.server.ServerRedirectStrategy;
 import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.util.Assert;
-import reactor.core.publisher.Mono;
-
-import java.net.URI;
 
 /**
  * Performs a redirect to a specified location.

web/src/main/java/org/springframework/security/web/server/authentication/RedirectServerAuthenticationSuccessHandler.java

@@ -16,6 +16,10 @@
 
 package org.springframework.security.web.server.authentication;
 
+import java.net.URI;
+
+import reactor.core.publisher.Mono;
+
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.server.DefaultServerRedirectStrategy;
 import org.springframework.security.web.server.ServerRedirectStrategy;
@@ -24,9 +28,6 @@ import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.security.web.server.savedrequest.WebSessionServerRequestCache;
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-import java.net.URI;
 
 /**
  * Performs a redirect on authentication success. The default is to redirect to a saved

web/src/main/java/org/springframework/security/web/server/authentication/ServerAuthenticationConverter.java

@@ -16,11 +16,11 @@
 
 package org.springframework.security.web.server.authentication;
 
+import reactor.core.publisher.Mono;
+
 import org.springframework.security.core.Authentication;
 import org.springframework.web.server.ServerWebExchange;
 
-import reactor.core.publisher.Mono;
-
 /**
  * A strategy used for converting from a {@link ServerWebExchange} to an
  * {@link Authentication} used for authenticating with a provided