title: Can't Set Spring Boot XSRF-TOKEN flag as Secure on Browser
body: <p>I'm running a security report that is indicating that Cookie is set with secure = False. Also the image below shows that XSRF-TOKEN does not have the Secure Column checked. I would like to know if there's any way to set this flag SECURE to TRUE </p>
  
  <p><a href="https://i.stack.imgur.com/IxA5p.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IxA5p.png" alt="enter image description here"></a></p>
  
  <p>I Added to my application.properties the entry:</p>
  
  <blockquote>
    <p>server.servlet.session.cookie.secure=true </p>
  </blockquote>
  
  <p>And I set the <strong>WebSecurityConfiguration</strong> as:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity 
  //@EnableGlobalMethodSecurity(prePostEnabled = true) 
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers("/", "/assets/**", "/*.css", "/*.js", "index.html");
      } 
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
           http
           .httpBasic()
           .authenticationEntryPoint(new CeaAuthenticationEntryPoint())
           .and()
           .authorizeRequests()
             .antMatchers("/index.html", "/", "/home", "/login","/logout", "/assets/**").permitAll() 
               .and()
           .csrf()
               .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); 
  
  
      }
  
      @Bean
      CorsConfigurationSource corsConfigurationSource() {
          CorsConfiguration configuration = new CorsConfiguration();
          configuration.setAllowedOrigins(Arrays.asList("*"));
          configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT", "PATCH"));
          configuration.setAllowedHeaders(Arrays.asList("X-Requested-With", "Origin", "Content-Type", "Accept", "Authorization"));
          configuration.setAllowCredentials(true);
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          source.registerCorsConfiguration("/**", configuration);
          return source;
      }
  }
  </code></pre>