code: public void setCookie(final HttpServletRequest prequest, final HttpServletResponse presponse)
        throws IOException {
      final CsrfToken csrf = (CsrfToken) prequest.getAttribute(CsrfToken.class.getName());
      if (csrf != null) {
        Cookie cookie = WebUtils.getCookie(prequest, ResourcePaths.XSRF_COOKIE);
        final String token = csrf.getToken();
        if (cookie == null || token != null && !token.equals(cookie.getValue())) {
          cookie = new Cookie(ResourcePaths.XSRF_COOKIE, token);
          cookie.setPath(
              StringUtils.defaultString(StringUtils.trimToNull(prequest.getContextPath()), "/"));
          presponse.addCookie(cookie);
        }
      }
    }
docs: set csrf/xsrf cookie.
  
  @param prequest http servlet request
  @param presponse http servlet response
  @throws IOException when io operation fails