title: Spring boot security adding 2 XSRF-TOKEN in response header cookies
body: <p>I am using spring boot 2.2 security and below is my Java configuration :</p>
  
  <pre><code> http.authorizeRequests().anyRequest().authenticated()
                  .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and().exceptionHandling().authenticationEntryPoint(authenticationFailureHandler)
                  .and().exceptionHandling().accessDeniedHandler(accessDeniedHandler)
  .and().httpBasic()
  .and().csrf().requireCsrfProtectionMatcher(csrfRequestMatcher)
                  .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
  </code></pre>
  
  <p>I see in the response header, 2 set-cookie for XSRF-TOKEN as below. Not sure why.</p>
  
  <p>set-cookie: <strong>XSRF-TOKEN=</strong>; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/hidden</p>
  
  <p>set-cookie: <strong>XSRF-TOKEN</strong>=5564cfc1-884d-4b89-9bb9-11a92f42bcc7; Path=/hidden</p>
  
  <p>What am I missing here? Relatively new to Spring security.</p>