Is it possible to add same-site attribute to Spring Security CSRF's .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) - spring-boot

Question

My security configuration has a following line:
...csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())...
Which sends a csrf cookie with every request back to client. This cookie has no same-site attribute set. Is it possible to add the same-site attribute as well? I looked around some methods inside that class and there is nothing about extra attributes to my knowledge.
How can this be done?

Answer 1

Unfortunately, as of version 4.0.1, the servlet-api doesn't allow you to add the Same-Site attribute to a Cookie. Hopefully this will change soon.
But in the meantime, you could provide your own CsrfTokenRepository implementation that instead of adding a Cookie to the HttpServletResponse (and thus being limited by the servlet-api's representation of a cookie), sets the cookie directly in HTTP header:
public class CustomCsrfTokenRepository implements CsrfTokenRepository {
// implement other methods...
#Override
public void saveToken(CsrfToken token, HttpServletRequest request,
HttpServletResponse response) {
// some version of this:
response.setHeader("Set-Cookie", "HttpOnly; SameSite=strict");
}
}
You can take a look at CookieCsrfTokenRepository to fill in the gaps.

Answer 2

Just to chime in and follow NatFars answer, this solution is especially simple in Kotlin where you can delegate to other objects without having to copy code from the original object in hacky ways:
class CookieCsrfTokenRepositoryWrapper(private val repo: CsrfTokenRepository): CsrfTokenRepository by repo {
override fun saveToken(token: CsrfToken?, req: HttpServletRequest?, res: HttpServletResponse?) {
repo.saveToken(token, req, res)
res?.getHeaders("Set-Cookie")?.toList()?.forEach {
if(it.contains("XSRF") && !it.contains("SameSite"))
res.setHeader("Set-Cookie", "$it; SameSite=strict")
}
}
}
val repo = CookieCsrfTokenRepositoryWrapper(CookieCsrfTokenRepository.withHttpOnlyFalse())
About delegation in Kotlin: https://kotlinlang.org/docs/reference/delegation.html