我找到解决办法了
1.首先，使用带有Consumer<ResponseCookie.ResponseCookieBuilder>的setCookieCustomizer metohd创建自定义CookieCsrfTokenRepository

CookieCsrfTokenRepository tokenRepository = new CookieCsrfTokenRepository();
        tokenRepository.setCookieCustomizer(new Consumer<ResponseCookie.ResponseCookieBuilder>() {
            
            @Override
            public void accept(ResponseCookieBuilder t) {
                t.sameSite("none");
                t.secure(true);
                t.httpOnly(false); //Js can read
            }
        });

字符串
1.适用于filterChain(HttpSecurity http)方法：

@Configuration
@EnableWebSecurity
public class SecurityJavaConfig {
@Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        
        //Configuramos el Csrf Token repository para tener una cookie cross domnain
        CookieCsrfTokenRepository tokenRepository = new CookieCsrfTokenRepository();
        tokenRepository.setCookieCustomizer(new Consumer<ResponseCookie.ResponseCookieBuilder>() {
            
            @Override
            public void accept(ResponseCookieBuilder t) {
                t.sameSite(csrfSameSiteCookie);
                t.secure(csrfSecureCookie);
                t.httpOnly(false); //Para que js pueda leer la cookie
            }
        });        
        
        http
            .cors((cors) -> cors.configurationSource(corsConfigurationSource()))
            .csrf((csrf) -> csrf
                    .csrfTokenRepository(tokenRepository)
            )
            .sessionManagement(session  -> session.sessionCreationPolicy(SessionCreationPolicy.ALWAYS))
            //Autorizaciones end-points
            .authorizeHttpRequests((authorize) -> authorize
                    .requestMatchers(HttpMethod.OPTIONS,"/**").permitAll()
                    .requestMatchers(HttpMethod.GET,"/csrf").permitAll()
                    .anyRequest().authenticated()
            )
            .httpBasic(withDefaults());;

 
        return http.build();
    }
}

型