Why does CookieCsrfTokenRepository use withHttpOnlyFalse(), when HttpOnly is usually a security best practice for cookies?

The CSRF token's protection model depends on your OWN frontend JavaScript being able to read the token value from the cookie and echo it back as a request header — this only works if JavaScript CAN read it. Security still holds because a DIFFERENT (attacker) origin cannot read your domain's cookies at all, due to Same-Origin Policy — HttpOnly would only additionally protect against XSS reading it, which is a different threat model from CSRF.