SEC-1132: More refactoring to remove cycles ad reduce complexity metrics

2026-08-05 17:57:15 +00:00 · 2009-05-04 14:24:54 +00:00
parent 73cfeecd0c
commit 6d655aa514
104 changed files with 530 additions and 534 deletions
@@ -16,6 +16,7 @@
 package org.springframework.security.web;

 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.access.ExceptionTranslationFilter;

 import java.io.IOException;

@@ -34,7 +34,7 @@ import javax.servlet.ServletResponse;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.web.intercept.FilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
 import org.springframework.security.web.util.AntUrlPathMatcher;
 import org.springframework.security.web.util.UrlMatcher;
 import org.springframework.util.Assert;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web;
+package org.springframework.security.web.access;

 import org.springframework.security.access.AccessDeniedException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web;
+package org.springframework.security.web.access;

 import java.io.IOException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web;
+package org.springframework.security.web.access;

 import java.io.IOException;

@@ -29,6 +29,11 @@ import org.springframework.security.authentication.AuthenticationTrustResolverIm
 import org.springframework.security.authentication.InsufficientAuthenticationException;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.PortResolver;
+import org.springframework.security.web.PortResolverImpl;
+import org.springframework.security.web.SpringSecurityFilter;
 import org.springframework.security.web.savedrequest.SavedRequest;
 import org.springframework.security.web.util.ThrowableAnalyzer;
 import org.springframework.security.web.util.ThrowableCauseExtractor;
@@ -47,8 +52,8 @@ import org.springframework.util.Assert;
 * <p>
 * If an {@link AccessDeniedException} is detected, the filter will determine whether or not the user is an anonymous
 * user. If they are an anonymous user, the <code>authenticationEntryPoint</code> will be launched. If they are not
- * an anonymous user, the filter will delegate to the {@link org.springframework.security.web.AccessDeniedHandler}.
- * By default the filter will use {@link org.springframework.security.web.AccessDeniedHandlerImpl}.
+ * an anonymous user, the filter will delegate to the {@link org.springframework.security.web.access.AccessDeniedHandler}.
+ * By default the filter will use {@link org.springframework.security.web.access.AccessDeniedHandlerImpl}.
 * <p>
 * To use this filter, it is necessary to specify the following properties:
 * <ul>
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access;

 import java.io.IOException;
 import java.util.List;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import org.springframework.security.web.PortMapper;
 import org.springframework.security.web.PortMapperImpl;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.web.FilterInvocation;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;


 import org.springframework.security.access.ConfigAttribute;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import java.io.IOException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import java.io.IOException;
 import java.util.Collection;
@@ -31,7 +31,7 @@ import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.web.FilterChainOrder;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.SpringSecurityFilter;
-import org.springframework.security.web.intercept.FilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
 import org.springframework.util.Assert;


@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.web.FilterInvocation;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import java.io.IOException;
 import java.util.List;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;


 /**
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 /**
 * Commences a secure channel by retrying the original request using HTTPS.
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import java.io.IOException;
 import java.util.List;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.ExpressionParser;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -10,8 +10,8 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.expression.ParseException;
 import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.web.intercept.DefaultFilterInvocationSecurityMetadataSource;
-import org.springframework.security.web.intercept.RequestKey;
+import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.access.intercept.RequestKey;
 import org.springframework.security.web.util.UrlMatcher;
 import org.springframework.util.Assert;

@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import org.springframework.expression.Expression;
 import org.springframework.security.access.ConfigAttribute;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import java.util.List;

@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.ExpressionParser;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import java.net.InetAddress;
 import java.net.UnknownHostException;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import java.util.Arrays;
 import java.util.Collection;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import org.springframework.security.access.intercept.SecurityMetadataSource;
 import org.springframework.security.web.FilterInvocation;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
 import org.springframework.security.access.intercept.InterceptorStatusToken;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 /**
 * @author Luke Taylor
@@ -1,4 +1,4 @@
-package org.springframework.security.web;
+package org.springframework.security.web.authentication;

 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
@@ -11,8 +11,7 @@ import javax.servlet.http.HttpServletResponse;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
-import org.springframework.security.web.logout.LogoutHandler;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
 import org.springframework.security.web.util.RedirectUtils;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
@@ -38,7 +38,7 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.SpringSecurityFilter;
-import org.springframework.security.web.util.SessionUtils;
+import org.springframework.security.web.session.SessionUtils;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;

@@ -172,11 +172,11 @@ public class AuthenticationProcessingFilter extends AbstractProcessingFilter {
        return FilterChainOrder.AUTHENTICATION_PROCESSING_FILTER;
    }

-    String getUsernameParameter() {
+    public final String getUsernameParameter() {
        return usernameParameter;
    }

-    String getPasswordParameter() {
+    public final String getPasswordParameter() {
        return passwordParameter;
    }
 }
@@ -19,11 +19,11 @@ package org.springframework.security.web.authentication;

 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
-import org.springframework.security.web.ExceptionTranslationFilter;
 import org.springframework.security.web.PortMapper;
 import org.springframework.security.web.PortMapperImpl;
 import org.springframework.security.web.PortResolver;
 import org.springframework.security.web.PortResolverImpl;
+import org.springframework.security.web.access.ExceptionTranslationFilter;
 import org.springframework.security.web.util.RedirectUrlBuilder;
 import org.springframework.security.web.util.UrlUtils;

@@ -8,7 +8,7 @@ import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;

 import org.springframework.security.core.Authentication;
-import org.springframework.security.web.ExceptionTranslationFilter;
+import org.springframework.security.web.access.ExceptionTranslationFilter;
 import org.springframework.security.web.savedrequest.SavedRequest;
 import org.springframework.security.web.util.RedirectUtils;
 import org.springframework.security.web.wrapper.SavedRequestAwareWrapper;
@@ -7,7 +7,6 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.core.Authentication;
-import org.springframework.security.web.AbstractAuthenticationTargetUrlRequestHandler;

 public class SimpleUrlAuthenticationSuccessHandler extends AbstractAuthenticationTargetUrlRequestHandler implements AuthenticationSuccessHandler {

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.concurrent;
+package org.springframework.security.web.authentication.concurrent;

 import org.springframework.security.authentication.concurrent.SessionInformation;
 import org.springframework.security.authentication.concurrent.SessionRegistry;
@@ -21,8 +21,8 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.FilterChainOrder;
 import org.springframework.security.web.SpringSecurityFilter;
-import org.springframework.security.web.logout.LogoutHandler;
-import org.springframework.security.web.logout.SecurityContextLogoutHandler;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;
@@ -44,7 +44,7 @@ import java.io.IOException;
 * {@link org.springframework.security.authentication.concurrent.SessionInformation} from the <code>SessionRegistry</code>
 * for each request and checks if the session has been marked as expired.
 * If it has been marked as expired, the configured logout handlers will be called (as happens with
- * {@link org.springframework.security.web.logout.LogoutFilter}), typically to invalidate the session.
+ * {@link org.springframework.security.web.authentication.logout.LogoutFilter}), typically to invalidate the session.
 * A redirect to the expiredURL specified will be performed, and the session invalidation will cause an
 * {@link org.springframework.security.web.session.HttpSessionDestroyedEvent} to be published via the
 * {@link org.springframework.security.web.session.HttpSessionEventPublisher} registered in <code>web.xml</code>.</p>
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.logout;
+package org.springframework.security.web.authentication.logout;

 import java.io.IOException;
 import java.util.Arrays;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.logout;
+package org.springframework.security.web.authentication.logout;

 import org.springframework.security.core.Authentication;

@@ -1,4 +1,4 @@
-package org.springframework.security.web.logout;
+package org.springframework.security.web.authentication.logout;

 import java.io.IOException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.logout;
+package org.springframework.security.web.authentication.logout;


 import org.springframework.security.core.Authentication;
@@ -1,4 +1,4 @@
-package org.springframework.security.web.logout;
+package org.springframework.security.web.authentication.logout;

 import java.io.IOException;

@@ -7,7 +7,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.core.Authentication;
-import org.springframework.security.web.AbstractAuthenticationTargetUrlRequestHandler;
+import org.springframework.security.web.authentication.AbstractAuthenticationTargetUrlRequestHandler;

 /**
 * Handles the navigation on logout by delegating to the {@link AbstractAuthenticationTargetUrlRequestHandler}
@@ -31,7 +31,7 @@ import org.springframework.core.Ordered;
 * This code is based on
 * {@link org.springframework.security.ui.x509.X509ProcessingFilterEntryPoint}.
 *
- * @see org.springframework.security.web.ExceptionTranslationFilter
+ * @see org.springframework.security.web.access.ExceptionTranslationFilter
 *
 * @author Luke Taylor
 * @author Ruud Senden
@@ -17,7 +17,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.web.authentication.RememberMeServices;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
-import org.springframework.security.web.logout.LogoutHandler;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;

@@ -1,4 +1,4 @@
-package org.springframework.security.web.authentication;
+package org.springframework.security.web.authentication.ui;

 import java.io.IOException;

@@ -12,6 +12,8 @@ import org.springframework.beans.BeanWrapperImpl;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.FilterChainOrder;
 import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.authentication.AbstractProcessingFilter;
+import org.springframework.security.web.authentication.AuthenticationProcessingFilter;
 import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;

 /**
@@ -1,6 +0,0 @@
-<html>
-<body>
-Concurrent session control and registration classes.
-</body>
-</html>
-
@@ -0,0 +1,2 @@
+Classes which are responsible for maintaining the security context
+between HTTP requests.
@@ -37,7 +37,7 @@ import java.util.TreeMap;
 * Represents central information from a <code>HttpServletRequest</code>.<p>This class is used by {@link
 * org.springframework.security.web.authentication.AbstractProcessingFilter} and {@link org.springframework.security.web.wrapper.SavedRequestAwareWrapper} to
 * reproduce the request after successful authentication. An instance of this class is stored at the time of an
- * authentication exception by {@link org.springframework.security.web.ExceptionTranslationFilter}.</p>
+ * authentication exception by {@link org.springframework.security.web.access.ExceptionTranslationFilter}.</p>
 * <p><em>IMPLEMENTATION NOTE</em>: It is assumed that this object is accessed only from the context of a single
 * thread, so no synchronization around internal collection classes is performed.</p>
 * <p>This class is based on code in Apache Tomcat.</p>
@@ -1,4 +1,4 @@
-package org.springframework.security.web;
+package org.springframework.security.web.session;

 import java.io.IOException;

@@ -14,8 +14,9 @@ import org.springframework.security.authentication.concurrent.SessionRegistry;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
-import org.springframework.security.web.util.SessionUtils;

 /**
 * Detects that a user has been authenticated since the start of the request and starts a new session.
@@ -1,4 +1,4 @@
-package org.springframework.security.web.util;
+package org.springframework.security.web.session;

 import java.util.Enumeration;
 import java.util.HashMap;
@@ -1,7 +1,7 @@
 package org.springframework.security.web.util;

 import org.springframework.security.web.authentication.AbstractProcessingFilter;
-import org.springframework.security.web.logout.LogoutFilter;
+import org.springframework.security.web.authentication.logout.LogoutFilter;

 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -1,348 +1,348 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.web.wrapper;
-
-import java.text.SimpleDateFormat;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-import java.util.Set;
-import java.util.TimeZone;
-
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpSession;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.web.PortResolver;
-import org.springframework.security.web.savedrequest.Enumerator;
-import org.springframework.security.web.savedrequest.FastHttpDateFormat;
-import org.springframework.security.web.savedrequest.SavedRequest;
-
-
-/**
- * Provides request parameters, headers and cookies from either an original request or a saved request.
- *
- * <p>Note that not all request parameters in the original request are emulated by this wrapper.
- * Nevertheless, the important data from the original request is emulated and this should prove
- * adequate for most purposes (in particular standard HTTP GET and POST operations).</p>
- *
- * <p>Added into a request by {@link org.springframework.security.web.wrapper.SecurityContextHolderAwareRequestFilter}.</p>
- *
- *
- * @see SecurityContextHolderAwareRequestFilter
- *
- * @author Andrey Grebnev
- * @author Ben Alex
- * @version $Id$
- */
-public class SavedRequestAwareWrapper extends SecurityContextHolderAwareRequestWrapper {
-    //~ Static fields/initializers =====================================================================================
-
-    protected static final Log logger = LogFactory.getLog(SavedRequestAwareWrapper.class);
-    protected static final TimeZone GMT_ZONE = TimeZone.getTimeZone("GMT");
-
-    /** The default Locale if none are specified. */
-    protected static Locale defaultLocale = Locale.getDefault();
-
-    //~ Instance fields ================================================================================================
-
-    protected SavedRequest savedRequest = null;
-
-    /**
-     * The set of SimpleDateFormat formats to use in getDateHeader(). Notice that because SimpleDateFormat is
-     * not thread-safe, we can't declare formats[] as a static variable.
-     */
-    protected SimpleDateFormat[] formats = new SimpleDateFormat[3];
-
-    //~ Constructors ===================================================================================================
-
-    public SavedRequestAwareWrapper(HttpServletRequest request, PortResolver portResolver, String rolePrefix) {
-        super(request, portResolver, rolePrefix);
-
-        HttpSession session = request.getSession(false);
-
-        if (session == null) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Wrapper not replaced; no session available for SavedRequest extraction");
-            }
-
-            return;
-        }
-
-        SavedRequest saved = (SavedRequest) session.getAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY);
-
-        if ((saved != null) && saved.doesRequestMatch(request, portResolver)) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Wrapper replaced; SavedRequest was: " + saved);
-            }
-
-            savedRequest = saved;
-            session.removeAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY);
-
-            formats[0] = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US);
-            formats[1] = new SimpleDateFormat("EEEEEE, dd-MMM-yy HH:mm:ss zzz", Locale.US);
-            formats[2] = new SimpleDateFormat("EEE MMMM d HH:mm:ss yyyy", Locale.US);
-
-            formats[0].setTimeZone(GMT_ZONE);
-            formats[1].setTimeZone(GMT_ZONE);
-            formats[2].setTimeZone(GMT_ZONE);
-        } else {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Wrapper not replaced; SavedRequest was: " + saved);
-            }
-        }
-    }
-
-    //~ Methods ========================================================================================================
-
-    @Override
-    public Cookie[] getCookies() {
-        if (savedRequest == null) {
-            return super.getCookies();
-        } else {
-            List<Cookie> cookies = savedRequest.getCookies();
-
-            return cookies.toArray(new Cookie[cookies.size()]);
-        }
-    }
-
-    @Override
-    public long getDateHeader(String name) {
-        if (savedRequest == null) {
-            return super.getDateHeader(name);
-        } else {
-            String value = getHeader(name);
-
-            if (value == null) {
-                return -1L;
-            }
-
-            // Attempt to convert the date header in a variety of formats
-            long result = FastHttpDateFormat.parseDate(value, formats);
-
-            if (result != -1L) {
-                return result;
-            }
-
-            throw new IllegalArgumentException(value);
-        }
-    }
-
-    @Override
-    public String getHeader(String name) {
-        if (savedRequest == null) {
-            return super.getHeader(name);
-        } else {
-            String header = null;
-            Iterator<String> iterator = savedRequest.getHeaderValues(name);
-
-            while (iterator.hasNext()) {
-                header = iterator.next();
-
-                break;
-            }
-
-            return header;
-        }
-    }
-
-    @Override
-    @SuppressWarnings("unchecked")
-    public Enumeration getHeaderNames() {
-        if (savedRequest == null) {
-            return super.getHeaderNames();
-        } else {
-            return new Enumerator<String>(savedRequest.getHeaderNames());
-        }
-    }
-
-    @Override
-    @SuppressWarnings("unchecked")
-    public Enumeration getHeaders(String name) {
-        if (savedRequest == null) {
-            return super.getHeaders(name);
-        } else {
-            return new Enumerator<String>(savedRequest.getHeaderValues(name));
-        }
-    }
-
-    @Override
-    public int getIntHeader(String name) {
-        if (savedRequest == null) {
-            return super.getIntHeader(name);
-        } else {
-            String value = getHeader(name);
-
-            if (value == null) {
-                return -1;
-            } else {
-                return Integer.parseInt(value);
-            }
-        }
-    }
-
-    @Override
-    public Locale getLocale() {
-        if (savedRequest == null) {
-            return super.getLocale();
-        } else {
-            Locale locale = null;
-            Iterator<Locale> iterator = savedRequest.getLocales();
-
-            while (iterator.hasNext()) {
-                locale = (Locale) iterator.next();
-
-                break;
-            }
-
-            if (locale == null) {
-                return defaultLocale;
-            } else {
-                return locale;
-            }
-        }
-    }
-
-    @Override
-    @SuppressWarnings("unchecked")
-    public Enumeration getLocales() {
-        if (savedRequest == null) {
-            return super.getLocales();
-        }
-
-        Iterator<Locale> iterator = savedRequest.getLocales();
-
-        if (iterator.hasNext()) {
-            return new Enumerator<Locale>(iterator);
-        }
-        // Fall back to default locale
-        ArrayList<Locale> results = new ArrayList<Locale>(1);
-        results.add(defaultLocale);
-
-        return new Enumerator<Locale>(results.iterator());
-    }
-
-    @Override
-    public String getMethod() {
-        if (savedRequest == null) {
-            return super.getMethod();
-        } else {
-            return savedRequest.getMethod();
-        }
-    }
-
-    /**
-     * If the parameter is available from the wrapped request then either
-     * <ol>
-     * <li>There is no saved request (it a normal request)</li>
-     * <li>There is a saved request, but the request has been forwarded/included to a URL with parameters, either
-     * supplementing or overriding the saved request values.</li>
-     * </ol>
-     * In both cases the value from the wrapped request should be used.
-     * <p>
-     * If the value from the wrapped request is null, an attempt will be made to retrieve the parameter
-     * from the SavedRequest, if available..
-     */
-    @Override
-    public String getParameter(String name) {
-        String value = super.getParameter(name);
-
-        if (value != null || savedRequest == null) {
-            return value;
-        }
-
-        String[] values = savedRequest.getParameterValues(name);
-        if (values == null || values.length == 0) {
-            return null;
-        }
-
-        return values[0];
-    }
-
-    @Override
-    @SuppressWarnings("unchecked")
-    public Map getParameterMap() {
-        if (savedRequest == null) {
-            return super.getParameterMap();
-        }
-
-        Set<String> names = getCombinedParameterNames();
-        Map<String, String[]> parameterMap = new HashMap<String, String[]>(names.size());
-
-        for (String name : names) {
-            parameterMap.put(name, getParameterValues(name));
-        }
-
-        return parameterMap;
-    }
-
-    @SuppressWarnings("unchecked")
-    private Set<String> getCombinedParameterNames() {
-        Set<String> names = new HashSet<String>();
-        names.addAll(super.getParameterMap().keySet());
-
-        if (savedRequest != null) {
-            names.addAll(savedRequest.getParameterMap().keySet());
-        }
-
-        return names;
-    }
-
-    @Override
-    @SuppressWarnings("unchecked")
-    public Enumeration getParameterNames() {
-        return new Enumerator(getCombinedParameterNames());
-    }
-
-    @Override
-    public String[] getParameterValues(String name) {
-        if (savedRequest == null) {
-            return super.getParameterValues(name);
-        }
-
-        String[] savedRequestParams = savedRequest.getParameterValues(name);
-        String[] wrappedRequestParams = super.getParameterValues(name);
-
-        if (savedRequestParams == null) {
-            return wrappedRequestParams;
-        }
-
-        if (wrappedRequestParams == null) {
-            return savedRequestParams;
-        }
-
-        // We have parameters in both saved and wrapped requests so have to merge them
-        List<String> wrappedParamsList = Arrays.asList(wrappedRequestParams);
-        List<String> combinedParams = new ArrayList<String>(wrappedParamsList);
-
-        // We want to add all parameters of the saved request *apart from* duplicates of those already added
-        for (int i = 0; i < savedRequestParams.length; i++) {
-            if (!wrappedParamsList.contains(savedRequestParams[i])) {
-                combinedParams.add(savedRequestParams[i]);
-            }
-        }
-
-        return combinedParams.toArray(new String[combinedParams.size()]);
-    }
-}
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.wrapper;
+
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.TimeZone;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.security.web.PortResolver;
+import org.springframework.security.web.savedrequest.Enumerator;
+import org.springframework.security.web.savedrequest.FastHttpDateFormat;
+import org.springframework.security.web.savedrequest.SavedRequest;
+
+
+/**
+ * Provides request parameters, headers and cookies from either an original request or a saved request.
+ *
+ * <p>Note that not all request parameters in the original request are emulated by this wrapper.
+ * Nevertheless, the important data from the original request is emulated and this should prove
+ * adequate for most purposes (in particular standard HTTP GET and POST operations).</p>
+ *
+ * <p>Added into a request by {@link org.springframework.security.web.wrapper.SecurityContextHolderAwareRequestFilter}.</p>
+ *
+ *
+ * @see SecurityContextHolderAwareRequestFilter
+ *
+ * @author Andrey Grebnev
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class SavedRequestAwareWrapper extends SecurityContextHolderAwareRequestWrapper {
+    //~ Static fields/initializers =====================================================================================
+
+    protected static final Log logger = LogFactory.getLog(SavedRequestAwareWrapper.class);
+    protected static final TimeZone GMT_ZONE = TimeZone.getTimeZone("GMT");
+
+    /** The default Locale if none are specified. */
+    protected static Locale defaultLocale = Locale.getDefault();
+
+    //~ Instance fields ================================================================================================
+
+    protected SavedRequest savedRequest = null;
+
+    /**
+     * The set of SimpleDateFormat formats to use in getDateHeader(). Notice that because SimpleDateFormat is
+     * not thread-safe, we can't declare formats[] as a static variable.
+     */
+    protected SimpleDateFormat[] formats = new SimpleDateFormat[3];
+
+    //~ Constructors ===================================================================================================
+
+    public SavedRequestAwareWrapper(HttpServletRequest request, PortResolver portResolver, String rolePrefix) {
+        super(request, portResolver, rolePrefix);
+
+        HttpSession session = request.getSession(false);
+
+        if (session == null) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Wrapper not replaced; no session available for SavedRequest extraction");
+            }
+
+            return;
+        }
+
+        SavedRequest saved = (SavedRequest) session.getAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY);
+
+        if ((saved != null) && saved.doesRequestMatch(request, portResolver)) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Wrapper replaced; SavedRequest was: " + saved);
+            }
+
+            savedRequest = saved;
+            session.removeAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY);
+
+            formats[0] = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US);
+            formats[1] = new SimpleDateFormat("EEEEEE, dd-MMM-yy HH:mm:ss zzz", Locale.US);
+            formats[2] = new SimpleDateFormat("EEE MMMM d HH:mm:ss yyyy", Locale.US);
+
+            formats[0].setTimeZone(GMT_ZONE);
+            formats[1].setTimeZone(GMT_ZONE);
+            formats[2].setTimeZone(GMT_ZONE);
+        } else {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Wrapper not replaced; SavedRequest was: " + saved);
+            }
+        }
+    }
+
+    //~ Methods ========================================================================================================
+
+    @Override
+    public Cookie[] getCookies() {
+        if (savedRequest == null) {
+            return super.getCookies();
+        } else {
+            List<Cookie> cookies = savedRequest.getCookies();
+
+            return cookies.toArray(new Cookie[cookies.size()]);
+        }
+    }
+
+    @Override
+    public long getDateHeader(String name) {
+        if (savedRequest == null) {
+            return super.getDateHeader(name);
+        } else {
+            String value = getHeader(name);
+
+            if (value == null) {
+                return -1L;
+            }
+
+            // Attempt to convert the date header in a variety of formats
+            long result = FastHttpDateFormat.parseDate(value, formats);
+
+            if (result != -1L) {
+                return result;
+            }
+
+            throw new IllegalArgumentException(value);
+        }
+    }
+
+    @Override
+    public String getHeader(String name) {
+        if (savedRequest == null) {
+            return super.getHeader(name);
+        } else {
+            String header = null;
+            Iterator<String> iterator = savedRequest.getHeaderValues(name);
+
+            while (iterator.hasNext()) {
+                header = iterator.next();
+
+                break;
+            }
+
+            return header;
+        }
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public Enumeration getHeaderNames() {
+        if (savedRequest == null) {
+            return super.getHeaderNames();
+        } else {
+            return new Enumerator<String>(savedRequest.getHeaderNames());
+        }
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public Enumeration getHeaders(String name) {
+        if (savedRequest == null) {
+            return super.getHeaders(name);
+        } else {
+            return new Enumerator<String>(savedRequest.getHeaderValues(name));
+        }
+    }
+
+    @Override
+    public int getIntHeader(String name) {
+        if (savedRequest == null) {
+            return super.getIntHeader(name);
+        } else {
+            String value = getHeader(name);
+
+            if (value == null) {
+                return -1;
+            } else {
+                return Integer.parseInt(value);
+            }
+        }
+    }
+
+    @Override
+    public Locale getLocale() {
+        if (savedRequest == null) {
+            return super.getLocale();
+        } else {
+            Locale locale = null;
+            Iterator<Locale> iterator = savedRequest.getLocales();
+
+            while (iterator.hasNext()) {
+                locale = (Locale) iterator.next();
+
+                break;
+            }
+
+            if (locale == null) {
+                return defaultLocale;
+            } else {
+                return locale;
+            }
+        }
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public Enumeration getLocales() {
+        if (savedRequest == null) {
+            return super.getLocales();
+        }
+
+        Iterator<Locale> iterator = savedRequest.getLocales();
+
+        if (iterator.hasNext()) {
+            return new Enumerator<Locale>(iterator);
+        }
+        // Fall back to default locale
+        ArrayList<Locale> results = new ArrayList<Locale>(1);
+        results.add(defaultLocale);
+
+        return new Enumerator<Locale>(results.iterator());
+    }
+
+    @Override
+    public String getMethod() {
+        if (savedRequest == null) {
+            return super.getMethod();
+        } else {
+            return savedRequest.getMethod();
+        }
+    }
+
+    /**
+     * If the parameter is available from the wrapped request then either
+     * <ol>
+     * <li>There is no saved request (it a normal request)</li>
+     * <li>There is a saved request, but the request has been forwarded/included to a URL with parameters, either
+     * supplementing or overriding the saved request values.</li>
+     * </ol>
+     * In both cases the value from the wrapped request should be used.
+     * <p>
+     * If the value from the wrapped request is null, an attempt will be made to retrieve the parameter
+     * from the SavedRequest, if available..
+     */
+    @Override
+    public String getParameter(String name) {
+        String value = super.getParameter(name);
+
+        if (value != null || savedRequest == null) {
+            return value;
+        }
+
+        String[] values = savedRequest.getParameterValues(name);
+        if (values == null || values.length == 0) {
+            return null;
+        }
+
+        return values[0];
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public Map getParameterMap() {
+        if (savedRequest == null) {
+            return super.getParameterMap();
+        }
+
+        Set<String> names = getCombinedParameterNames();
+        Map<String, String[]> parameterMap = new HashMap<String, String[]>(names.size());
+
+        for (String name : names) {
+            parameterMap.put(name, getParameterValues(name));
+        }
+
+        return parameterMap;
+    }
+
+    @SuppressWarnings("unchecked")
+    private Set<String> getCombinedParameterNames() {
+        Set<String> names = new HashSet<String>();
+        names.addAll(super.getParameterMap().keySet());
+
+        if (savedRequest != null) {
+            names.addAll(savedRequest.getParameterMap().keySet());
+        }
+
+        return names;
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public Enumeration getParameterNames() {
+        return new Enumerator(getCombinedParameterNames());
+    }
+
+    @Override
+    public String[] getParameterValues(String name) {
+        if (savedRequest == null) {
+            return super.getParameterValues(name);
+        }
+
+        String[] savedRequestParams = savedRequest.getParameterValues(name);
+        String[] wrappedRequestParams = super.getParameterValues(name);
+
+        if (savedRequestParams == null) {
+            return wrappedRequestParams;
+        }
+
+        if (wrappedRequestParams == null) {
+            return savedRequestParams;
+        }
+
+        // We have parameters in both saved and wrapped requests so have to merge them
+        List<String> wrappedParamsList = Arrays.asList(wrappedRequestParams);
+        List<String> combinedParams = new ArrayList<String>(wrappedParamsList);
+
+        // We want to add all parameters of the saved request *apart from* duplicates of those already added
+        for (int i = 0; i < savedRequestParams.length; i++) {
+            if (!wrappedParamsList.contains(savedRequestParams[i])) {
+                combinedParams.add(savedRequestParams[i]);
+            }
+        }
+
+        return combinedParams.toArray(new String[combinedParams.size()]);
+    }
+}
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web;
+package org.springframework.security.web.access;

 import java.io.IOException;

@@ -35,8 +35,8 @@ import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.AccessDeniedHandlerImpl;
-import org.springframework.security.web.ExceptionTranslationFilter;
+import org.springframework.security.web.access.AccessDeniedHandlerImpl;
+import org.springframework.security.web.access.ExceptionTranslationFilter;
 import org.springframework.security.web.savedrequest.SavedRequest;

 /**
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access;

 import static org.junit.Assert.*;
 import static org.mockito.Matchers.*;
@@ -32,10 +32,12 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;


 /**
- * Tests {@link org.springframework.security.web.intercept.WebInvocationPrivilegeEvaluator}.
+ * Tests {@link org.springframework.security.web.access.WebInvocationPrivilegeEvaluator}.
 *
 * @author Ben Alex
 * @version $Id$
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import static org.mockito.Mockito.mock;

@@ -32,8 +32,8 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.securechannel.ChannelDecisionManagerImpl;
-import org.springframework.security.web.securechannel.ChannelProcessor;
+import org.springframework.security.web.access.channel.ChannelDecisionManagerImpl;
+import org.springframework.security.web.access.channel.ChannelProcessor;


 /**
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.mock;
@@ -31,9 +31,9 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.intercept.FilterInvocationSecurityMetadataSource;
-import org.springframework.security.web.securechannel.ChannelDecisionManager;
-import org.springframework.security.web.securechannel.ChannelProcessingFilter;
+import org.springframework.security.web.access.channel.ChannelDecisionManager;
+import org.springframework.security.web.access.channel.ChannelProcessingFilter;
+import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;


 /**
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import static org.mockito.Mockito.mock;

@@ -25,7 +25,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.securechannel.InsecureChannelProcessor;
+import org.springframework.security.web.access.channel.InsecureChannelProcessor;


 /**
@@ -13,14 +13,14 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import junit.framework.TestCase;

 import org.springframework.security.MockPortResolver;

 import org.springframework.security.web.PortMapperImpl;
-import org.springframework.security.web.securechannel.RetryWithHttpEntryPoint;
+import org.springframework.security.web.access.channel.RetryWithHttpEntryPoint;

 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -13,14 +13,14 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import junit.framework.TestCase;

 import org.springframework.security.MockPortResolver;

 import org.springframework.security.web.PortMapperImpl;
-import org.springframework.security.web.securechannel.RetryWithHttpsEntryPoint;
+import org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint;

 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.securechannel;
+package org.springframework.security.web.access.channel;

 import static org.mockito.Mockito.mock;

@@ -25,7 +25,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.securechannel.SecureChannelProcessor;
+import org.springframework.security.web.access.channel.SecureChannelProcessor;


 /**
@@ -1,4 +1,4 @@
-package org.springframework.security.web.expression;
+package org.springframework.security.web.access.expression;

 import static org.junit.Assert.*;
 import static org.mockito.Mockito.mock;
@@ -10,6 +10,7 @@ import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;
+import org.springframework.security.web.access.expression.WebSecurityExpressionRoot;

 /**
 * Tests for {@link WebSecurityExpressionRoot}.
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import static org.junit.Assert.*;
 import static org.mockito.Mockito.mock;
@@ -29,8 +29,8 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.intercept.DefaultFilterInvocationSecurityMetadataSource;
-import org.springframework.security.web.intercept.RequestKey;
+import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.access.intercept.RequestKey;
 import org.springframework.security.web.util.AntUrlPathMatcher;

 /**
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import static org.junit.Assert.assertEquals;
 import static org.mockito.Mockito.mock;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import java.util.List;

@@ -38,6 +38,8 @@ import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.FilterInvocation;
+import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;


 /**
@@ -1,9 +1,9 @@
-package org.springframework.security.web.intercept;
+package org.springframework.security.web.access.intercept;

 import static org.junit.Assert.*;

 import org.junit.Test;
-import org.springframework.security.web.intercept.RequestKey;
+import org.springframework.security.web.access.intercept.RequestKey;

 /**
 * 
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.concurrent;
+package org.springframework.security.web.authentication;

 import junit.framework.TestCase;
 import org.springframework.mock.web.MockFilterConfig;
@@ -22,7 +22,7 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.mock.web.MockHttpSession;
 import org.springframework.security.authentication.concurrent.SessionRegistry;
 import org.springframework.security.authentication.concurrent.SessionRegistryImpl;
-import org.springframework.security.web.concurrent.ConcurrentSessionFilter;
+import org.springframework.security.web.authentication.concurrent.ConcurrentSessionFilter;

 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -17,6 +17,7 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;

 /**
 *
@@ -1,11 +1,11 @@
-package org.springframework.security.web.logout;
+package org.springframework.security.web.authentication.logout;

 import junit.framework.TestCase;

 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.web.logout.LogoutFilter;
-import org.springframework.security.web.logout.SecurityContextLogoutHandler;
+import org.springframework.security.web.authentication.logout.LogoutFilter;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;

 /**
 * @author Luke Taylor
@@ -1,4 +1,4 @@
-package org.springframework.security.web;
+package org.springframework.security.web.session;

 import static org.junit.Assert.*;

@@ -11,8 +11,8 @@ import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.SessionFixationProtectionFilter;
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
+import org.springframework.security.web.session.SessionFixationProtectionFilter;

 /**
 *
@@ -14,7 +14,6 @@ import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.web.PortResolverImpl;
 import org.springframework.security.web.savedrequest.FastHttpDateFormat;
 import org.springframework.security.web.savedrequest.SavedRequest;
-import org.springframework.security.web.wrapper.SavedRequestAwareWrapper;

 public class SavedRequestAwareWrapperTests {

@@ -26,7 +26,6 @@ import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.web.PortResolverImpl;
-import org.springframework.security.web.wrapper.SavedRequestAwareWrapper;
 import org.springframework.security.web.wrapper.SecurityContextHolderAwareRequestFilter;