Xor CSRF token

[JohnNiang]

What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

What this PR does / why we need it:

This PR makes XOR operation for CSRF token and changes the CSRF cookie HttpOnly to true to forbid JavaScript from accessing the cookie.

See https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-token-request-handler-breach for more details.

Special notes for your reviewer:

http http://localhost:8090/login -ph

HTTP/1.1 200 OK
set-cookie: XSRF-TOKEN=6d5dd83f-f0a7-4d94-a33e-73f213d679ff; Path=/; HTTPOnly

http http://localhost:8090/login -pb | grep _csrf

><input type="hidden" name="_csrf" value="ctubmrEC3dAbxC5H_k_-VnVUtih2BrfjcPfLmVAyaP0a1kAdEb-t_IcwuLM29B11yGLKNRQxm0lFZILOFZX-_GcHWJ974iR5"/>

Does this PR introduce a user-facing change?

None

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 57.06%. Comparing base (5df755d) to head (137107b).
Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #6798   +/-   ##
=========================================
  Coverage     57.06%   57.06%           
  Complexity     3980     3980           
=========================================
  Files           710      710           
  Lines         23972    23972           
  Branches       1569     1569           
=========================================
  Hits          13680    13680           
  Misses         9680     9680           
  Partials        612      612           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ruibaby]

/lgtm

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[guqing]

/lgtm

[f2c-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: guqing

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [guqing]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment