Add the cors-csrf module

cors-csrf/src/main/resources/application.yml

@@ -0,0 +1,25 @@
+# Every scenario in the article is a profile. The default is `securitysource`, the
+# configuration that works, so that a bare `mvn spring-boot:run` starts something sane.
+spring:
+  application:
+    name: cors-csrf-samesite
+  profiles:
+    default: securitysource
+
+server:
+  port: 8080
+  servlet:
+    session:
+      cookie:
+        # Boot writes exactly what you put here. It does NOT add `Secure` for you when
+        # same-site is `none`, which is the whole subject of docs/07-samesite.md. Flip
+        # SESSION_SAME_SITE / SESSION_SECURE from scripts/scenario-samesite.sh and read the
+        # emitted Set-Cookie header back.
+        same-site: ${SESSION_SAME_SITE:lax}
+        secure: ${SESSION_SECURE:false}
+        http-only: true
+
+logging:
+  level:
+    org.springframework.security.web.csrf: ${CSRF_LOG_LEVEL:INFO}
+    org.springframework.web.cors: ${CORS_LOG_LEVEL:INFO}