public String generateState(HttpRequest request, HttpResponse response, int timeoutInSeconds) {
    // Create a state token to prevent request forgery.
    // Store it in the cookie for later validation.
    String state = new BigInteger(130, new SecureRandom()).toString(32);
    response.addHeader(SET_COOKIE, newCookieBuilder(request)
      .setName(CSRF_STATE_COOKIE)
      .setValue(state)
      .setHttpOnly(false)
      .setExpiry(timeoutInSeconds)
      .setSameSite(SAMESITE_LAX)
      .toValueString());
    return state;
  }
@Test
  public void generate_state() {
    String state = underTest.generateState(request, response, TIMEOUT);
    assertThat(state).isNotEmpty();

    verify(response).addHeader(SET_COOKIE, String.format("XSRF-TOKEN=%s; Path=/; SameSite=Lax; Max-Age=30", state));
  }