SEC-2655: CsrfFilter could return token as header

stripybadger (Migrated from SEC-2655) said:

The CsrfFilter sets the csrf token as an attribute in the request. This is great if you're using a jsp, as you can then embed the token into your page.

If you're not using a jsp, this is annoying. For example, many webapps now use simple html pages that load javascript, and then make ajax requests. It would be useful therefore if the CsrfFilter could set the token in a header as well. This would enable javascripty clients to extract the value from the header, store it, and then use it in subsequent ajax requests.

I'm aware that I could write an additional filter to achieve this, but it seems like something simple that could usefully be included in CsrfFilter.

Note that prior to https://github.com/spring-projects/spring-security/commit/48283ec0049b4245a8887ffaf89d60416fb12203#diff-21c30055f2a19cf6fb7e1f8116ed07e5L77 it did used to return the token in a header - I'm not clear why though.

Locate CsrfFilter and review how it currently places the CSRF token in the request, then compare that behavior with the referenced commit. Check the issue's comment thread for additional context. Done means the filter also exposes the token through a response header while preserving the existing request attribute behavior, with tests covering the change.