Make classes final where possible

Update classes that have private constructors so that they are also
declared final. In a few cases, inner-classes used private constructors
but were subclassed. These have now been changed to have package-private
constructors.

Issue gh-8945

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/provisioning/UserDetailsManagerConfigurer.java

@@ -104,7 +104,7 @@ public class UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>, C
 	 * Builds the user to be added. At minimum the username, password, and authorities
 	 * should provided. The remaining attributes have reasonable defaults.
 	 */
-	public class UserDetailsBuilder {
+	public final class UserDetailsBuilder {
 
 		private UserBuilder user;
 

config/src/main/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.java

@@ -164,7 +164,7 @@ public class RSocketSecurity {
 	/**
 	 * @since 5.3
 	 */
-	public class SimpleAuthenticationSpec {
+	public final class SimpleAuthenticationSpec {
 
 		private ReactiveAuthenticationManager authenticationManager;
 
@@ -208,7 +208,7 @@ public class RSocketSecurity {
 		return this;
 	}
 
-	public class BasicAuthenticationSpec {
+	public final class BasicAuthenticationSpec {
 
 		private ReactiveAuthenticationManager authenticationManager;
 
@@ -244,7 +244,7 @@ public class RSocketSecurity {
 		return this;
 	}
 
-	public class JwtSpec {
+	public final class JwtSpec {
 
 		private ReactiveAuthenticationManager authenticationManager;
 
@@ -370,7 +370,7 @@ public class RSocketSecurity {
 			return new Access(matcher);
 		}
 
-		public class Access {
+		public final class Access {
 
 			private final PayloadExchangeMatcher matcher;
 

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -2942,10 +2942,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 
 		protected List<RequestMatcher> matchers = new ArrayList<>();
 
-		/**
-		 * @param context
-		 */
-		private RequestMatcherConfigurer(ApplicationContext context) {
+		RequestMatcherConfigurer(ApplicationContext context) {
 			setApplicationContext(context);
 		}
 

config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java

@@ -337,7 +337,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	 */
 	public class IgnoredRequestConfigurer extends AbstractRequestMatcherRegistry<IgnoredRequestConfigurer> {
 
-		private IgnoredRequestConfigurer(ApplicationContext context) {
+		IgnoredRequestConfigurer(ApplicationContext context) {
 			setApplicationContext(context);
 		}
 

config/src/main/java/org/springframework/security/config/annotation/web/configurers/ChannelSecurityConfigurer.java

@@ -220,7 +220,7 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
 
 		protected List<? extends RequestMatcher> requestMatchers;
 
-		private RequiresChannelUrl(List<? extends RequestMatcher> requestMatchers) {
+		RequiresChannelUrl(List<? extends RequestMatcher> requestMatchers) {
 			this.requestMatchers = requestMatchers;
 		}
 

config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java

@@ -303,8 +303,8 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
 	 * @since 5.2
 	 */
 	private SessionAuthenticationStrategy getSessionAuthenticationStrategy() {
-		if (sessionAuthenticationStrategy != null) {
-			return sessionAuthenticationStrategy;
+		if (this.sessionAuthenticationStrategy != null) {
+			return this.sessionAuthenticationStrategy;
 		}
 		else {
 			return new CsrfAuthenticationStrategy(this.csrfTokenRepository);
@@ -321,10 +321,7 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
 	 */
 	private class IgnoreCsrfProtectionRegistry extends AbstractRequestMatcherRegistry<IgnoreCsrfProtectionRegistry> {
 
-		/**
-		 * @param context
-		 */
-		private IgnoreCsrfProtectionRegistry(ApplicationContext context) {
+		IgnoreCsrfProtectionRegistry(ApplicationContext context) {
 			setApplicationContext(context);
 		}
 

config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java

@@ -109,7 +109,7 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
 		return REGISTRY;
 	}
 
-	public class ExpressionInterceptUrlRegistry extends
+	public final class ExpressionInterceptUrlRegistry extends
 			ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<ExpressionInterceptUrlRegistry, AuthorizedUrl> {
 
 		/**
@@ -130,7 +130,7 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
 		}
 
 		@Override
-		protected final AuthorizedUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
+		protected AuthorizedUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
 			return new AuthorizedUrl(requestMatchers);
 		}
 
@@ -267,7 +267,7 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
 	 *
 	 * @author Rob Winch
 	 */
-	public class MvcMatchersAuthorizedUrl extends AuthorizedUrl {
+	public final class MvcMatchersAuthorizedUrl extends AuthorizedUrl {
 
 		/**
 		 * Creates a new instance
@@ -296,7 +296,7 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
 		 * Creates a new instance
 		 * @param requestMatchers the {@link RequestMatcher} instances to map
 		 */
-		private AuthorizedUrl(List<? extends RequestMatcher> requestMatchers) {
+		AuthorizedUrl(List<? extends RequestMatcher> requestMatchers) {
 			this.requestMatchers = requestMatchers;
 		}
 

config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java

@@ -113,7 +113,7 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
 		return this;
 	}
 
-	public class StandardInterceptUrlRegistry extends
+	public final class StandardInterceptUrlRegistry extends
 			ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<StandardInterceptUrlRegistry, AuthorizedUrl> {
 
 		/**
@@ -134,7 +134,7 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
 		}
 
 		@Override
-		protected final AuthorizedUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
+		protected AuthorizedUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
 			return new AuthorizedUrl(requestMatchers);
 		}
 
@@ -275,7 +275,7 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
 		 * @param requestMatchers the {@link RequestMatcher} instances to map to some
 		 * {@link ConfigAttribute} instances.
 		 */
-		private AuthorizedUrl(List<? extends RequestMatcher> requestMatchers) {
+		AuthorizedUrl(List<? extends RequestMatcher> requestMatchers) {
 			Assert.notEmpty(requestMatchers, "requestMatchers must contain at least one value");
 			this.requestMatchers = requestMatchers;
 		}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurer.java

@@ -154,7 +154,7 @@ public final class OAuth2ClientConfigurer<B extends HttpSecurityBuilder<B>>
 	/**
 	 * Configuration options for the OAuth 2.0 Authorization Code Grant.
 	 */
-	public class AuthorizationCodeGrantConfigurer {
+	public final class AuthorizationCodeGrantConfigurer {
 
 		private OAuth2AuthorizationRequestResolver authorizationRequestResolver;
 

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java

@@ -224,7 +224,7 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 	/**
 	 * Configuration options for the Authorization Server's Authorization Endpoint.
 	 */
-	public class AuthorizationEndpointConfig {
+	public final class AuthorizationEndpointConfig {
 
 		private String authorizationRequestBaseUri;
 
@@ -308,7 +308,7 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 	/**
 	 * Configuration options for the Authorization Server's Token Endpoint.
 	 */
-	public class TokenEndpointConfig {
+	public final class TokenEndpointConfig {
 
 		private OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient;
 
@@ -364,7 +364,7 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 	/**
 	 * Configuration options for the Client's Redirection Endpoint.
 	 */
-	public class RedirectionEndpointConfig {
+	public final class RedirectionEndpointConfig {
 
 		private String authorizationResponseBaseUri;
 
@@ -416,7 +416,7 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 	/**
 	 * Configuration options for the Authorization Server's UserInfo Endpoint.
 	 */
-	public class UserInfoEndpointConfig {
+	public final class UserInfoEndpointConfig {
 
 		private OAuth2UserService<OAuth2UserRequest, OAuth2User> userService;
 

config/src/main/java/org/springframework/security/config/annotation/web/messaging/MessageSecurityMetadataSourceRegistry.java

@@ -251,7 +251,7 @@ public class MessageSecurityMetadataSourceRegistry {
 	 * Represents the security constraint to be applied to the {@link MessageMatcher}
 	 * instances.
 	 */
-	public class Constraint {
+	public final class Constraint {
 
 		private final List<? extends MatcherBuilder> messageMatchers;
 
@@ -409,7 +409,7 @@ public class MessageSecurityMetadataSourceRegistry {
 		return "hasAnyAuthority('" + anyAuthorities + "')";
 	}
 
-	private static class PreBuiltMatcherBuilder implements MatcherBuilder {
+	private final static class PreBuiltMatcherBuilder implements MatcherBuilder {
 
 		private MessageMatcher<?> matcher;
 
@@ -423,7 +423,7 @@ public class MessageSecurityMetadataSourceRegistry {
 
 	}
 
-	private class PathMatcherMessageMatcherBuilder implements MatcherBuilder {
+	private final class PathMatcherMessageMatcherBuilder implements MatcherBuilder {
 
 		private final String pattern;
 

config/src/main/java/org/springframework/security/config/http/GrantedAuthorityDefaultsParserUtils.java

@@ -27,7 +27,10 @@ import org.springframework.security.config.core.GrantedAuthorityDefaults;
  * @author Rob Winch
  * @since 4.2
  */
-class GrantedAuthorityDefaultsParserUtils {
+final class GrantedAuthorityDefaultsParserUtils {
+
+	private GrantedAuthorityDefaultsParserUtils() {
+	}
 
 	static RootBeanDefinition registerWithDefaultRolePrefix(ParserContext pc,
 			Class<? extends AbstractGrantedAuthorityDefaultsBeanFactory> beanFactoryClass) {
@@ -60,7 +63,4 @@ class GrantedAuthorityDefaultsParserUtils {
 
 	}
 
-	private GrantedAuthorityDefaultsParserUtils() {
-	}
-
 }

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -628,10 +628,13 @@ public class ServerHttpSecurity {
 	 * Configures CORS support within Spring Security. This ensures that the
 	 * {@link CorsWebFilter} is place in the correct order.
 	 */
-	public class CorsSpec {
+	public final class CorsSpec {
 
 		private CorsWebFilter corsFilter;
 
+		private CorsSpec() {
+		}
+
 		/**
 		 * Configures the {@link CorsConfigurationSource} to be used
 		 * @param source the source to use
@@ -683,9 +686,6 @@ public class ServerHttpSecurity {
 			return this.corsFilter;
 		}
 
-		private CorsSpec() {
-		}
-
 	}
 
 	/**
@@ -874,12 +874,15 @@ public class ServerHttpSecurity {
 	 * @since 5.2
 	 * @see #x509()
 	 */
-	public class X509Spec {
+	public final class X509Spec {
 
 		private X509PrincipalExtractor principalExtractor;
 
 		private ReactiveAuthenticationManager authenticationManager;
 
+		private X509Spec() {
+		}
+
 		public X509Spec principalExtractor(X509PrincipalExtractor principalExtractor) {
 			this.principalExtractor = principalExtractor;
 			return this;
@@ -923,9 +926,6 @@ public class ServerHttpSecurity {
 			return authenticationManager;
 		}
 
-		private X509Spec() {
-		}
-
 	}
 
 	/**
@@ -981,7 +981,7 @@ public class ServerHttpSecurity {
 		return this;
 	}
 
-	public class OAuth2LoginSpec {
+	public final class OAuth2LoginSpec {
 
 		private ReactiveClientRegistrationRepository clientRegistrationRepository;
 
@@ -1003,6 +1003,9 @@ public class ServerHttpSecurity {
 
 		private ServerAuthenticationFailureHandler authenticationFailureHandler;
 
+		private OAuth2LoginSpec() {
+		}
+
 		/**
 		 * Configures the {@link ReactiveAuthenticationManager} to use. The default is
 		 * {@link OAuth2AuthorizationCodeReactiveAuthenticationManager}
@@ -1378,9 +1381,6 @@ public class ServerHttpSecurity {
 			return service;
 		}
 
-		private OAuth2LoginSpec() {
-		}
-
 	}
 
 	/**
@@ -1434,7 +1434,7 @@ public class ServerHttpSecurity {
 		return this;
 	}
 
-	public class OAuth2ClientSpec {
+	public final class OAuth2ClientSpec {
 
 		private ReactiveClientRegistrationRepository clientRegistrationRepository;
 
@@ -1446,6 +1446,9 @@ public class ServerHttpSecurity {
 
 		private ServerAuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository;
 
+		private OAuth2ClientSpec() {
+		}
+
 		/**
 		 * Sets the converter to use
 		 * @param authenticationConverter the converter to use
@@ -1595,9 +1598,6 @@ public class ServerHttpSecurity {
 			return service;
 		}
 
-		private OAuth2ClientSpec() {
-		}
-
 	}
 
 	/**
@@ -1794,8 +1794,9 @@ public class ServerHttpSecurity {
 
 			if (this.authenticationManagerResolver != null) {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(this.authenticationManagerResolver);
-				oauth2.setServerAuthenticationConverter(bearerTokenConverter);
-				oauth2.setAuthenticationFailureHandler(new ServerAuthenticationEntryPointFailureHandler(entryPoint));
+				oauth2.setServerAuthenticationConverter(this.bearerTokenConverter);
+				oauth2.setAuthenticationFailureHandler(
+						new ServerAuthenticationEntryPointFailureHandler(this.entryPoint));
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 			else if (this.jwt != null) {
@@ -1961,8 +1962,9 @@ public class ServerHttpSecurity {
 			protected void configure(ServerHttpSecurity http) {
 				ReactiveAuthenticationManager authenticationManager = getAuthenticationManager();
 				AuthenticationWebFilter oauth2 = new BearerTokenAuthenticationWebFilter(authenticationManager);
-				oauth2.setServerAuthenticationConverter(bearerTokenConverter);
-				oauth2.setAuthenticationFailureHandler(new ServerAuthenticationEntryPointFailureHandler(entryPoint));
+				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
+				oauth2.setAuthenticationFailureHandler(
+						new ServerAuthenticationEntryPointFailureHandler(OAuth2ResourceServerSpec.this.entryPoint));
 				// @formatter:off
 				http
 					.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
@@ -2003,7 +2005,7 @@ public class ServerHttpSecurity {
 		 * @author Josh Cummings
 		 * @since 5.2
 		 */
-		public class OpaqueTokenSpec {
+		public final class OpaqueTokenSpec {
 
 			private String introspectionUri;
 
@@ -2013,6 +2015,9 @@ public class ServerHttpSecurity {
 
 			private Supplier<ReactiveOpaqueTokenIntrospector> introspector;
 
+			private OpaqueTokenSpec() {
+			}
+
 			/**
 			 * Configures the URI of the Introspection endpoint
 			 * @param introspectionUri The URI of the Introspection endpoint
@@ -2071,14 +2076,12 @@ public class ServerHttpSecurity {
 			protected void configure(ServerHttpSecurity http) {
 				ReactiveAuthenticationManager authenticationManager = getAuthenticationManager();
 				AuthenticationWebFilter oauth2 = new BearerTokenAuthenticationWebFilter(authenticationManager);
-				oauth2.setServerAuthenticationConverter(bearerTokenConverter);
-				oauth2.setAuthenticationFailureHandler(new ServerAuthenticationEntryPointFailureHandler(entryPoint));
+				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
+				oauth2.setAuthenticationFailureHandler(
+						new ServerAuthenticationEntryPointFailureHandler(OAuth2ResourceServerSpec.this.entryPoint));
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 
-			private OpaqueTokenSpec() {
-			}
-
 		}
 
 		public ServerHttpSecurity and() {
@@ -2820,7 +2823,7 @@ public class ServerHttpSecurity {
 	 * @since 5.0
 	 * @see #csrf()
 	 */
-	public class CsrfSpec {
+	public final class CsrfSpec {
 
 		private CsrfWebFilter filter = new CsrfWebFilter();
 
@@ -2917,7 +2920,7 @@ public class ServerHttpSecurity {
 	 * @since 5.0
 	 * @see #exceptionHandling()
 	 */
-	public class ExceptionHandlingSpec {
+	public final class ExceptionHandlingSpec {
 
 		/**
 		 * Configures what to do when the application request authentication
@@ -2963,7 +2966,7 @@ public class ServerHttpSecurity {
 	 * @since 5.0
 	 * @see #requestCache()
 	 */
-	public class RequestCacheSpec {
+	public final class RequestCacheSpec {
 
 		private ServerRequestCache requestCache = new WebSessionServerRequestCache();
 
@@ -3013,7 +3016,7 @@ public class ServerHttpSecurity {
 	 * @since 5.0
 	 * @see #httpBasic()
 	 */
-	public class HttpBasicSpec {
+	public final class HttpBasicSpec {
 
 		private ReactiveAuthenticationManager authenticationManager;
 
@@ -3104,7 +3107,7 @@ public class ServerHttpSecurity {
 	 * @since 5.0
 	 * @see #formLogin()
 	 */
-	public class FormLoginSpec {
+	public final class FormLoginSpec {
 
 		private final RedirectServerAuthenticationSuccessHandler defaultSuccessHandler = new RedirectServerAuthenticationSuccessHandler(
 				"/");
@@ -3282,7 +3285,7 @@ public class ServerHttpSecurity {
 
 	}
 
-	private class LoginPageSpec {
+	private final class LoginPageSpec {
 
 		protected void configure(ServerHttpSecurity http) {
 			if (http.authenticationEntryPoint != null) {
@@ -3321,7 +3324,7 @@ public class ServerHttpSecurity {
 	 * @since 5.0
 	 * @see #headers()
 	 */
-	public class HeaderSpec {
+	public final class HeaderSpec {
 
 		private final List<ServerHttpHeadersWriter> writers;
 
@@ -3535,7 +3538,7 @@ public class ServerHttpSecurity {
 		 *
 		 * @see #cache()
 		 */
-		public class CacheSpec {
+		public final class CacheSpec {
 
 			/**
 			 * Disables cache control response headers
@@ -3556,7 +3559,7 @@ public class ServerHttpSecurity {
 		 *
 		 * @see #contentTypeOptions()
 		 */
-		public class ContentTypeOptionsSpec {
+		public final class ContentTypeOptionsSpec {
 
 			/**
 			 * Disables the content type options response header
@@ -3577,7 +3580,7 @@ public class ServerHttpSecurity {
 		 *
 		 * @see #frameOptions()
 		 */
-		public class FrameOptionsSpec {
+		public final class FrameOptionsSpec {
 
 			/**
 			 * The mode to configure. Default is
@@ -3618,7 +3621,7 @@ public class ServerHttpSecurity {
 		 *
 		 * @see #hsts()
 		 */
-		public class HstsSpec {
+		public final class HstsSpec {
 
 			/**
 			 * Configures the max age. Default is one year.
@@ -3687,7 +3690,10 @@ public class ServerHttpSecurity {
 		 *
 		 * @see #xssProtection()
 		 */
-		public class XssProtectionSpec {
+		public final class XssProtectionSpec {
+
+			private XssProtectionSpec() {
+			}
 
 			/**
 			 * Disables the x-xss-protection response header
@@ -3698,9 +3704,6 @@ public class ServerHttpSecurity {
 				return HeaderSpec.this;
 			}
 
-			private XssProtectionSpec() {
-			}
-
 		}
 
 		/**
@@ -3709,7 +3712,7 @@ public class ServerHttpSecurity {
 		 * @since 5.1
 		 * @see #contentSecurityPolicy(String)
 		 */
-		public class ContentSecurityPolicySpec {
+		public final class ContentSecurityPolicySpec {
 
 			private static final String DEFAULT_SRC_SELF_POLICY = "default-src 'self'";
 
@@ -3760,7 +3763,7 @@ public class ServerHttpSecurity {
 		 * @since 5.1
 		 * @see #featurePolicy(String)
 		 */
-		public class FeaturePolicySpec {
+		public final class FeaturePolicySpec {
 
 			/**
 			 * Allows method chaining to continue configuring the
@@ -3784,7 +3787,11 @@ public class ServerHttpSecurity {
 		 * @see #referrerPolicy()
 		 * @see #referrerPolicy(ReferrerPolicy)
 		 */
-		public class ReferrerPolicySpec {
+		public final class ReferrerPolicySpec {
+
+			private ReferrerPolicySpec(ReferrerPolicy referrerPolicy) {
+				HeaderSpec.this.referrerPolicy.setPolicy(referrerPolicy);
+			}
 
 			/**
 			 * Sets the policy to be used in the response header.
@@ -3808,10 +3815,6 @@ public class ServerHttpSecurity {
 			private ReferrerPolicySpec() {
 			}
 
-			private ReferrerPolicySpec(ReferrerPolicy referrerPolicy) {
-				HeaderSpec.this.referrerPolicy.setPolicy(referrerPolicy);
-			}
-
 		}
 
 		private HeaderSpec() {
@@ -4095,17 +4098,18 @@ public class ServerHttpSecurity {
 		}
 
 		protected void configure(ServerHttpSecurity http) {
-			if (authenticationFilter == null) {
-				authenticationFilter = new AnonymousAuthenticationWebFilter(getKey(), principal, authorities);
+			if (this.authenticationFilter == null) {
+				this.authenticationFilter = new AnonymousAuthenticationWebFilter(getKey(), this.principal,
+						this.authorities);
 			}
-			http.addFilterAt(authenticationFilter, SecurityWebFiltersOrder.ANONYMOUS_AUTHENTICATION);
+			http.addFilterAt(this.authenticationFilter, SecurityWebFiltersOrder.ANONYMOUS_AUTHENTICATION);
 		}
 
 		private String getKey() {
-			if (key == null) {
-				key = UUID.randomUUID().toString();
+			if (this.key == null) {
+				this.key = UUID.randomUUID().toString();
 			}
-			return key;
+			return this.key;
 		}
 
 		private AnonymousSpec() {

config/src/test/java/org/springframework/security/config/annotation/web/AbstractConfiguredSecurityBuilderTests.java

@@ -144,7 +144,7 @@ public class AbstractConfiguredSecurityBuilderTests {
 
 	}
 
-	private static class TestConfiguredSecurityBuilder
+	private static final class TestConfiguredSecurityBuilder
 			extends AbstractConfiguredSecurityBuilder<Object, TestConfiguredSecurityBuilder> {
 
 		private TestConfiguredSecurityBuilder(ObjectPostProcessor<Object> objectPostProcessor) {

config/src/test/java/org/springframework/security/htmlunit/server/WebTestClientHtmlUnitDriverBuilder.java

@@ -30,7 +30,7 @@ import org.springframework.test.web.servlet.htmlunit.webdriver.WebConnectionHtml
  * @author Rob Winch
  * @since 5.0
  */
-public class WebTestClientHtmlUnitDriverBuilder {
+public final class WebTestClientHtmlUnitDriverBuilder {
 
 	private final WebTestClient webTestClient;