Expected Behavior

"CookieCsrfTokenRepository" does allow you to set the cookies "maxAge" value, therefore it seems like it's Reactive counterpart "CookieServerCsrfTokenRepository" should also support it by allowing you to set the max age or using the default of "-1".

Current Behavior

It is either being set "-1" by default if the token is not empty or 0 if it is empty. .maxAge(!tokenValue.isEmpty() ? -1 : 0)

Therefore you cannot set it yourself.

Context

I had this in mind since I was curious about what would I need to be able to set my SESSION and X-CSRF cookies to not expire when the browser is closed to allow users of my SPA to not have to login every time the browser closes. But I don't know if the functionality is not being yet implemented for the X-CSRF cookie because of an specific reason.

More context about my problem

Suggested solution

PR: #11433