From c94fc1184619be979156fa5eed85b543913c74c8 Mon Sep 17 00:00:00 2001
From: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
Date: Sat, 11 Oct 2025 18:37:25 +0700
Subject: [PATCH 1/2] Fix-typos

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
---
 .../org/springframework/security/acls/AclEntryVoter.java | 2 +-
 .../security/acls/jdbc/BasicLookupStrategy.java          | 9 +++++----
 .../web/authentication/switchuser/SwitchUserFilter.java  | 2 +-
 .../server/csrf/WebSessionServerCsrfTokenRepository.java | 2 +-
 .../header/CacheControlServerHttpHeadersWriter.java      | 4 ++--
 .../security/web/util/ThrowableAnalyzer.java             | 4 ++--
 .../header/CacheControlServerHttpHeadersWriterTests.java | 2 +-
 .../header/StaticServerHttpHeadersWriterTests.java       | 8 ++++----
 .../XXssProtectionServerHttpHeadersWriterTests.java      | 2 +-
 9 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/access/src/main/java/org/springframework/security/acls/AclEntryVoter.java b/access/src/main/java/org/springframework/security/acls/AclEntryVoter.java
index e25b97bc0f7..845024154c9 100644
--- a/access/src/main/java/org/springframework/security/acls/AclEntryVoter.java
+++ b/access/src/main/java/org/springframework/security/acls/AclEntryVoter.java
@@ -71,7 +71,7 @@
  * <tt>AclEntryVoter</tt>:
  * <ul>
  * <li>Process domain object class <code>BankAccount</code>, configuration attribute
- * <code>VOTE_ACL_BANK_ACCONT_READ</code>, require permission
+ * <code>VOTE_ACL_BANK_ACCOUNT_READ</code>, require permission
  * <code>BasePermission.READ</code></li>
  * <li>Process domain object class <code>BankAccount</code>, configuration attribute
  * <code>VOTE_ACL_BANK_ACCOUNT_WRITE</code>, require permission list
diff --git a/acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java b/acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java
index 18f93d0fd85..6f5499d19ba 100644
--- a/acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java
+++ b/acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java
@@ -65,10 +65,11 @@
  * NB: This implementation does attempt to provide reasonably optimised lookups - within
  * the constraints of a normalised database and standard ANSI SQL features. If you are
  * willing to sacrifice either of these constraints (e.g. use a particular database
- * feature such as hierarchical queries or materalized views, or reduce normalisation) you
- * are likely to achieve better performance. In such situations you will need to provide
- * your own custom <code>LookupStrategy</code>. This class does not support subclassing,
- * as it is likely to change in future releases and therefore subclassing is unsupported.
+ * feature such as hierarchical queries or materialized views, or reduce normalisation)
+ * you are likely to achieve better performance. In such situations you will need to
+ * provide your own custom <code>LookupStrategy</code>. This class does not support
+ * subclassing, as it is likely to change in future releases and therefore subclassing is
+ * unsupported.
  * <p>
  * There are two SQL queries executed, one in the <tt>lookupPrimaryKeys</tt> method and
  * one in <tt>lookupObjectIdentities</tt>. These are built from the same select and "order
diff --git a/web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java b/web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java
index 2dc50d3fe26..5f262928dc1 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java
@@ -99,7 +99,7 @@
  * <p>
  * To configure the Switch User Processing Filter, create a bean definition for the Switch
  * User processing filter and add to the filterChainProxy. Note that the filter must come
- * <b>after</b> the <tt>FilterSecurityInteceptor</tt> in the chain, in order to apply the
+ * <b>after</b> the <tt>FilterSecurityInterceptor</tt> in the chain, in order to apply the
  * correct constraints to the <tt>switchUserUrl</tt>. Example:
  *
  * <pre>
diff --git a/web/src/main/java/org/springframework/security/web/server/csrf/WebSessionServerCsrfTokenRepository.java b/web/src/main/java/org/springframework/security/web/server/csrf/WebSessionServerCsrfTokenRepository.java
index 5466267035e..fa4f851e69f 100644
--- a/web/src/main/java/org/springframework/security/web/server/csrf/WebSessionServerCsrfTokenRepository.java
+++ b/web/src/main/java/org/springframework/security/web/server/csrf/WebSessionServerCsrfTokenRepository.java
@@ -102,7 +102,7 @@ public void setHeaderName(String headerName) {
 	 * @param sessionAttributeName the new attribute name to use
 	 */
 	public void setSessionAttributeName(String sessionAttributeName) {
-		Assert.hasLength(sessionAttributeName, "sessionAttributename cannot be null or empty");
+		Assert.hasLength(sessionAttributeName, "sessionAttributeName cannot be null or empty");
 		this.sessionAttributeName = sessionAttributeName;
 	}
 
diff --git a/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java b/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java
index 2e1660226e9..b9612ea1a74 100644
--- a/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java
+++ b/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java
@@ -49,13 +49,13 @@ public class CacheControlServerHttpHeadersWriter implements ServerHttpHeadersWri
 	/**
 	 * The value for cache control value
 	 */
-	public static final String CACHE_CONTRTOL_VALUE = "no-cache, no-store, max-age=0, must-revalidate";
+	public static final String CACHE_CONTROL_VALUE = "no-cache, no-store, max-age=0, must-revalidate";
 
 	/**
 	 * The delegate to write all the cache control related headers
 	 */
 	private static final ServerHttpHeadersWriter CACHE_HEADERS = StaticServerHttpHeadersWriter.builder()
-		.header(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE)
+		.header(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTROL_VALUE)
 		.header(HttpHeaders.PRAGMA, CacheControlServerHttpHeadersWriter.PRAGMA_VALUE)
 		.header(HttpHeaders.EXPIRES, CacheControlServerHttpHeadersWriter.EXPIRES_VALUE)
 		.build();
diff --git a/web/src/main/java/org/springframework/security/web/util/ThrowableAnalyzer.java b/web/src/main/java/org/springframework/security/web/util/ThrowableAnalyzer.java
index 48a5a79fdb9..72d788924e0 100755
--- a/web/src/main/java/org/springframework/security/web/util/ThrowableAnalyzer.java
+++ b/web/src/main/java/org/springframework/security/web/util/ThrowableAnalyzer.java
@@ -204,8 +204,8 @@ public final Throwable[] determineCauseChain(Throwable throwable) {
 
 	/**
 	 * Verifies that the provided throwable is a valid subclass of the provided type (or
-	 * of the type itself). If <code>expectdBaseType</code> is <code>null</code>, no check
-	 * will be performed.
+	 * of the type itself). If <code>expectedBaseType</code> is <code>null</code>, no
+	 * check will be performed.
 	 * <p>
 	 * Can be used for verification purposes in implementations of
 	 * {@link ThrowableCauseExtractor extractors}.
diff --git a/web/src/test/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriterTests.java b/web/src/test/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriterTests.java
index 9b001860775..e30e484abe2 100644
--- a/web/src/test/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriterTests.java
+++ b/web/src/test/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriterTests.java
@@ -44,7 +44,7 @@ public void writeHeadersWhenCacheHeadersThenWritesAllCacheControl() {
 		this.writer.writeHttpHeaders(this.exchange);
 		assertThat(this.headers.headerNames()).hasSize(3);
 		assertThat(this.headers.get(HttpHeaders.CACHE_CONTROL))
-			.containsOnly(CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE);
+			.containsOnly(CacheControlServerHttpHeadersWriter.CACHE_CONTROL_VALUE);
 		assertThat(this.headers.get(HttpHeaders.EXPIRES))
 			.containsOnly(CacheControlServerHttpHeadersWriter.EXPIRES_VALUE);
 		assertThat(this.headers.get(HttpHeaders.PRAGMA)).containsOnly(CacheControlServerHttpHeadersWriter.PRAGMA_VALUE);
diff --git a/web/src/test/java/org/springframework/security/web/server/header/StaticServerHttpHeadersWriterTests.java b/web/src/test/java/org/springframework/security/web/server/header/StaticServerHttpHeadersWriterTests.java
index c9c4a978113..34de507d5e1 100644
--- a/web/src/test/java/org/springframework/security/web/server/header/StaticServerHttpHeadersWriterTests.java
+++ b/web/src/test/java/org/springframework/security/web/server/header/StaticServerHttpHeadersWriterTests.java
@@ -69,7 +69,7 @@ public void writeHeadersWhenHeaderWrittenWithDifferentCaseThenDoesNotWriteHeader
 		// due to the fact that gh-10557 reports NettyHeadersAdapter as the
 		// response headers implementation, which is not accessible here.
 		HttpHeaders caseSensitiveHeaders = new HttpHeaders(new LinkedMultiValueMap<>());
-		caseSensitiveHeaders.set(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE);
+		caseSensitiveHeaders.set(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTROL_VALUE);
 		caseSensitiveHeaders.set(HttpHeaders.PRAGMA, CacheControlServerHttpHeadersWriter.PRAGMA_VALUE);
 		caseSensitiveHeaders.set(HttpHeaders.EXPIRES, CacheControlServerHttpHeadersWriter.EXPIRES_VALUE);
 		this.writer = new StaticServerHttpHeadersWriter(caseSensitiveHeaders);
@@ -80,13 +80,13 @@ public void writeHeadersWhenHeaderWrittenWithDifferentCaseThenDoesNotWriteHeader
 	@Test
 	public void writeHeadersWhenMultiHeaderThenWritesAllHeaders() {
 		this.writer = StaticServerHttpHeadersWriter.builder()
-			.header(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE)
+			.header(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTROL_VALUE)
 			.header(HttpHeaders.PRAGMA, CacheControlServerHttpHeadersWriter.PRAGMA_VALUE)
 			.header(HttpHeaders.EXPIRES, CacheControlServerHttpHeadersWriter.EXPIRES_VALUE)
 			.build();
 		this.writer.writeHttpHeaders(this.exchange);
 		assertThat(this.headers.get(HttpHeaders.CACHE_CONTROL))
-			.containsOnly(CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE);
+			.containsOnly(CacheControlServerHttpHeadersWriter.CACHE_CONTROL_VALUE);
 		assertThat(this.headers.get(HttpHeaders.PRAGMA)).containsOnly(CacheControlServerHttpHeadersWriter.PRAGMA_VALUE);
 		assertThat(this.headers.get(HttpHeaders.EXPIRES))
 			.containsOnly(CacheControlServerHttpHeadersWriter.EXPIRES_VALUE);
@@ -97,7 +97,7 @@ public void writeHeadersWhenMultiHeaderAndSingleWrittenThenNoHeadersOverridden()
 		String headerValue = "other";
 		this.headers.set(HttpHeaders.CACHE_CONTROL, headerValue);
 		this.writer = StaticServerHttpHeadersWriter.builder()
-			.header(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE)
+			.header(HttpHeaders.CACHE_CONTROL, CacheControlServerHttpHeadersWriter.CACHE_CONTROL_VALUE)
 			.header(HttpHeaders.PRAGMA, CacheControlServerHttpHeadersWriter.PRAGMA_VALUE)
 			.header(HttpHeaders.EXPIRES, CacheControlServerHttpHeadersWriter.EXPIRES_VALUE)
 			.build();
diff --git a/web/src/test/java/org/springframework/security/web/server/header/XXssProtectionServerHttpHeadersWriterTests.java b/web/src/test/java/org/springframework/security/web/server/header/XXssProtectionServerHttpHeadersWriterTests.java
index 5e24a139111..b242e695e04 100644
--- a/web/src/test/java/org/springframework/security/web/server/header/XXssProtectionServerHttpHeadersWriterTests.java
+++ b/web/src/test/java/org/springframework/security/web/server/header/XXssProtectionServerHttpHeadersWriterTests.java
@@ -52,7 +52,7 @@ public void writeHeadersWhenNoHeadersThenWriteHeaders() {
 	}
 
 	@Test
-	public void writeHeadersWhenHeaderWrittenThenDoesNotOverrride() {
+	public void writeHeadersWhenHeaderWrittenThenDoesNotOverride() {
 		String headerValue = "value";
 		this.headers.set(XXssProtectionServerHttpHeadersWriter.X_XSS_PROTECTION, headerValue);
 		this.writer.writeHttpHeaders(this.exchange);

From 4ccd2c356b644ff9b3371a26523af2e0b922f556 Mon Sep 17 00:00:00 2001
From: Rob Winch <362503+rwinch@users.noreply.github.com>
Date: Thu, 16 Oct 2025 13:45:45 -0500
Subject: [PATCH 2/2] Deprecate
 CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE

The member is public, so we need to deprecate it rather than remove it.

Issue gh-18035

Closes gh-18058
---
 .../server/header/CacheControlServerHttpHeadersWriter.java | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java b/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java
index b9612ea1a74..c4fad5afcf7 100644
--- a/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java
+++ b/web/src/main/java/org/springframework/security/web/server/header/CacheControlServerHttpHeadersWriter.java
@@ -51,6 +51,13 @@ public class CacheControlServerHttpHeadersWriter implements ServerHttpHeadersWri
 	 */
 	public static final String CACHE_CONTROL_VALUE = "no-cache, no-store, max-age=0, must-revalidate";
 
+	/**
+	 * The value for the cache control value.
+	 * @deprecated Please use {@link #CACHE_CONTROL_VALUE}
+	 */
+	@Deprecated(forRemoval = true, since = "7.0")
+	public static final String CACHE_CONTRTOL_VALUE = CACHE_CONTROL_VALUE;
+
 	/**
 	 * The delegate to write all the cache control related headers
 	 */