Add the cors-csrf module

cors-csrf/docs/output/10-csrf-spa.txt

@@ -0,0 +1,47 @@
+==============================================================================
+docs/output/10-csrf-spa.txt
+The same flow under csrf.spa(), added in Spring Security 7.0.
+Profile: csrfspa
+==============================================================================
+
+# 1. The bootstrap GET now DOES set the cookie.
+HTTP/1.1 200 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+Set-Cookie: XSRF-TOKEN=<token>; Path=/
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+# 2. POST with no token still fails, as it must.
+HTTP/1.1 401 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
+WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
+
+# 3. POST echoing the raw cookie value in X-XSRF-TOKEN.
+HTTP/1.1 200 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+{"created":true,"received":"{}","cookies":"XSRF-TOKEN"}
+
+# Note the cookie attributes: Path=/ and nothing else. No SameSite, no Secure,
+# no HttpOnly. A cookie with no SameSite attribute is treated as Lax, so a
+# genuinely cross-site SPA still never receives it. See 12.