Mark CsrfTokenRequestAttributeHandler#setCsrfRequestAttributeName as Nullable

Closes: gh-18617

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>

Author: therepanic

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestAttributeHandler.java

@@ -20,6 +20,7 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.jspecify.annotations.Nullable;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
@@ -33,12 +34,14 @@
  *
  * @author Steve Riesenberg
  * @author Yoobin Yoon
+ * @author Andrey Litvitski
  * @since 5.8
  */
 public class CsrfTokenRequestAttributeHandler implements CsrfTokenRequestHandler {
 
 	private static final Log logger = LogFactory.getLog(CsrfTokenRequestAttributeHandler.class);
 
+	@Nullable
 	private String csrfRequestAttributeName = "_csrf";
 
 	/**
@@ -49,7 +52,7 @@ public class CsrfTokenRequestAttributeHandler implements CsrfTokenRequestHandler
 	 * @param csrfRequestAttributeName the name of an additional request attribute with
 	 * the value of the CsrfToken. Default is {@link CsrfToken#getParameterName()}
 	 */
-	public final void setCsrfRequestAttributeName(String csrfRequestAttributeName) {
+	public final void setCsrfRequestAttributeName(@Nullable String csrfRequestAttributeName) {
 		this.csrfRequestAttributeName = csrfRequestAttributeName;
 	}