Spring Security Remove Servlet 2.5 and 3.0 Support for Remember Me

Related to #6220

The AbstractRememberMeServices attempts to use the setHttpOnly method only if that method is available in javax.servlet.http.Cookie.

Since Spring Framework 5.0 has a Servlet Spec baseline of 3.1, this check is no longer necessary.

We should always use the setHttpOnly method and remove any corresponding Servlet 2.5 or 3.0 tests.

Comment From: studyforbetter

can you tell me how to use it by xml configer ,

Comment From: jzheaux

@studyforbetter there isn't anything special to do for XML in this case. CookieCsrfTokenRepository is configured by both the Java config as well as the XML config in the same way.

Comment From: dongmyo

@jzheaux I'd like to take it

Comment From: jzheaux

@dongmyo It's yours