CookieCsrfTokenRepository resets httpOnly to true in case a cookieCustomizer is set

[stipx]

spring-security/web/src/main/java/org/springframework/security/web/csrf/CookieCsrfTokenRepository.java

Lines 179 to 183 in 8d58113

	public static CookieCsrfTokenRepository withHttpOnlyFalse() {
	CookieCsrfTokenRepository result = new CookieCsrfTokenRepository();
	result.setCookieCustomizer((cookie) -> cookie.httpOnly(false));
	return result;
	}

The withHttpOnlyFalse() factory method does lead to unexpected behavior if a customizer is set as the default httpOnly=true is set again and not reset in

spring-security/web/src/main/java/org/springframework/security/web/csrf/CookieCsrfTokenRepository.java

Line 98 in 8d58113

this.cookieCustomizer.accept(cookieBuilder);

[jzheaux]

Thanks, good catch @stipx. This will go into the next maintenance release.