CSRF cookie should be refreshed on each request

[FroMage]

Describe the bug

ATM the CSRF filter only sets a CSRF cookie for safe methods (like GET) if it does not exist, but it never refreshes it.

So, for example, what can happen, since the cookie expires after 10 minutes, is the following:

• T + 0 minutes : GET, get a CSRF cookie, OK
• T + 1 minute : GET, existing CSRF cookie sent in request, no new CSRF cookie in response, OK
• T + 2 minutes : POST, existing CSRF cookie sent in request, no new CSRF cookie in response, OK
• T + 9 minute : GET, existing CSRF cookie sent in request, no new CSRF cookie in response, OK
• T + 11 minutes : POST, expired CSRF cookie NOT sent in request, FAIL

We should refresh the CSRF cookie on every request, safe or even POST. This has been reported by several users independently.

[quarkus-bot]

/cc @pedroigor (bearer-token), @sberyozkin (bearer-token,jwt,security)

[ia3andy]

Thanks @FroMage It looks like what I experienced 👍

[sberyozkin]

@FroMage @ia3andy Do you mean that when the cookie has arrived and verified, it is then removed, and created again with the same value ?

[FroMage]

Same value, and expired date renewed for X more time.