Code review comment: Should this situation really abort the request if token is incorrect? I think it should verify and generate a new cookie if verification fails. I think it would resolve @FroMage 's concern about changed signature key (stuck cookie).  What is the reason for converting a request header to a cookie? Based on my understanding, the important part is preserving the cookie token btw requests.

Code under review:
public void filter(ResteasyReactiveContainerRequestContext requestContext, RoutingContext routing) {
        final CsrfReactiveConfig config = this.configInstance.get();

        String cookieToken = getCookieToken(routing, config);
        if (cookieToken != null) {
            try {
                int cookieTokenSize = Base64.getUrlDecoder().decode(cookieToken).length;
                
                int expectedCookieTokenSize = config.tokenSignatureKey.isPresent() ? 32 : config.tokenSize;
                if (cookieTokenSize != expectedCookieTokenSize) {
                    LOG.debugf("Invalid CSRF token cookie size: expected %d, got %d", expectedCookieTokenSize,
                            cookieTokenSize);
                    requestContext.abortWith(badClientRequest());
                    return;
                }
            } catch (IllegalArgumentException e) {
                LOG.debugf("Invalid CSRF token cookie: %s", cookieToken);
                requestContext.abortWith(badClientRequest());
                return;
            }
        }

        if (requestMethodIsSafe(requestContext)) {
            
            if (isCsrfTokenRequired(routing, config)) {
                if (cookieToken == null) {
                    generateNewCsrfToken(routing, config);
                } else {
                    String csrfTokenHeaderParam = requestContext.getHeaderString(config.tokenHeaderName);
                    if (csrfTokenHeaderParam != null) {
                        LOG.debugf("CSRF token found in the token header");
                        
                        verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenHeaderParam);
                    } else if (!config.tokenSignatureKey.isEmpty()) {
                        
                        
                        
                        
                        generateNewCsrfToken(routing, config);
                    } else {
                        
                        routing.put(CSRF_TOKEN_KEY, cookieToken);
                        routing.put(CSRF_TOKEN_BYTES_KEY, Base64.getUrlDecoder().decode(cookieToken));
                    }
                }
                routing.put(NEW_COOKIE_REQUIRED, true);
            }
        } else if (config.verifyToken) {
            

            
            String csrfTokenHeaderParam = requestContext.getHeaderString(config.tokenHeaderName);
            if (csrfTokenHeaderParam != null) {
                LOG.debugf("CSRF token found in the token header");
                verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenHeaderParam);
                return;
            }

            
            MediaType mediaType = requestContext.getMediaType();
            if (!isMatchingMediaType(mediaType, MediaType.APPLICATION_FORM_URLENCODED_TYPE)
                    && !isMatchingMediaType(mediaType, MediaType.MULTIPART_FORM_DATA_TYPE)) {
                if (config.requireFormUrlEncoded) {
                    LOG.debugf("Request has the wrong media type: %s", mediaType);
                    requestContext.abortWith(badClientRequest());
                    return;
                } else {
                    LOG.debugf("Request has the media type: %s, skipping the token verification",
                            mediaType);
                    return;
                }
            }

            if (!requestContext.hasEntity()) {
                LOG.debug("Request has no entity");
                requestContext.abortWith(badClientRequest());
                return;
            }

            ResteasyReactiveRequestContext rrContext = (ResteasyReactiveRequestContext) requestContext
                    .getServerRequestContext();
            String csrfTokenFormParam = (String) rrContext.getFormParameter(config.formFieldName, true, false);
            LOG.debugf("CSRF token found in the form parameter");
            verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenFormParam);

        } else if (cookieToken == null) {
            LOG.debug("CSRF token is not found");
            requestContext.abortWith(badClientRequest());
        }
    }

Line commented on: verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenHeaderParam);

Revised code:
public void filter(ResteasyReactiveContainerRequestContext requestContext, RoutingContext routing) {
        final CsrfReactiveConfig config = this.configInstance.get();

        String cookieToken = getCookieToken(routing, config);
        if (cookieToken != null) {
            try {
                int cookieTokenSize = Base64.getUrlDecoder().decode(cookieToken).length;
                
                int expectedCookieTokenSize = config.tokenSignatureKey.isPresent() ? 32 : config.tokenSize;
                if (cookieTokenSize != expectedCookieTokenSize) {
                    LOG.debugf("Invalid CSRF token cookie size: expected %d, got %d", expectedCookieTokenSize,
                            cookieTokenSize);
                    requestContext.abortWith(badClientRequest());
                    return;
                }
            } catch (IllegalArgumentException e) {
                LOG.debugf("Invalid CSRF token cookie: %s", cookieToken);
                requestContext.abortWith(badClientRequest());
                return;
            }
        }

        if (requestMethodIsSafe(requestContext)) {
            
            if (isCsrfTokenRequired(routing, config)) {
                if (cookieToken == null) {
                    generateNewCsrfToken(routing, config);
                } else {
                    String csrfTokenHeaderParam = requestContext.getHeaderString(config.tokenHeaderName);
                    if (csrfTokenHeaderParam != null) {
                        LOG.debugf("CSRF token found in the token header");
                        
                        verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenHeaderParam);
                    } else if (!config.tokenSignatureKey.isEmpty()) {
                        
                        
                        
                        
                        generateNewCsrfToken(routing, config);
                    } else {
                        
                        routing.put(CSRF_TOKEN_KEY, cookieToken);
                        routing.put(CSRF_TOKEN_BYTES_KEY, Base64.getUrlDecoder().decode(cookieToken));
                    }
                }
                routing.put(NEW_COOKIE_REQUIRED, true);
            }
        } else if (config.verifyToken) {
            

            
            String csrfTokenHeaderParam = requestContext.getHeaderString(config.tokenHeaderName);
            if (csrfTokenHeaderParam != null) {
                LOG.debugf("CSRF token found in the token header");
                verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenHeaderParam);
                return;
            }

            
            MediaType mediaType = requestContext.getMediaType();
            if (!isMatchingMediaType(mediaType, MediaType.APPLICATION_FORM_URLENCODED_TYPE)
                    && !isMatchingMediaType(mediaType, MediaType.MULTIPART_FORM_DATA_TYPE)) {
                if (config.requireFormUrlEncoded) {
                    LOG.debugf("Request has the wrong media type: %s", mediaType);
                    requestContext.abortWith(badClientRequest());
                    return;
                } else {
                    LOG.debugf("Request has the media type: %s, skipping the token verification",
                            mediaType);
                    return;
                }
            }

            if (!requestContext.hasEntity()) {
                LOG.debug("Request has no entity");
                requestContext.abortWith(badClientRequest());
                return;
            }

            ResteasyReactiveRequestContext rrContext = (ResteasyReactiveRequestContext) requestContext
                    .getServerRequestContext();
            String csrfTokenFormParam = (String) rrContext.getFormParameter(config.formFieldName, true, false);
            LOG.debugf("CSRF token found in the form parameter");
            verifyCsrfToken(requestContext, routing, config, cookieToken, csrfTokenFormParam);

        } else if (cookieToken == null) {
            LOG.debug("CSRF token is not found");
            requestContext.abortWith(badClientRequest());
        }
    }