static String resubmitSavedForm(@NonNull String savedFormData, @NonNull String savedRequest,
            HttpServletRequest originalRequest, HttpServletResponse originalResponse,
            ServletContext servletContext, boolean rememberedAjaxResubmit)
            throws InterruptedException, IOException {
        if (log.isDebugEnabled()) {
            log.debug("saved form data: {}", savedFormData);
            log.debug("Set Cookie Headers: {}", originalResponse.getHeaders(SET_COOKIE));
            log.debug("Original Request Headers: {}", Collections.list(originalRequest.getHeaderNames()));
            log.debug("Original Request Cookie Header: {}", Collections.list(originalRequest.getHeaders(COOKIE)));
        }
        if (Boolean.TRUE.toString().equals(originalRequest.getHeader(FORM_IS_RESUBMITTED))) {
            log.debug("Form resubmit: internal auth failure");
            originalResponse.setStatus(AUTHFAIL);
            return resubmitResponseCleanup(originalRequest);
        }
        URI overriddenRequestURI = overrideSavedRequestURI(URI.create(savedRequest));
        HttpClient client = buildHttpClient(overriddenRequestURI, servletContext, originalRequest);
        HttpResponse<String> response;
        PartialAjaxResult decodedFormData;
        try {
            decodedFormData = parseFormData(savedFormData, overriddenRequestURI, client, servletContext);
            HttpRequest postRequest = constructPostRequest(overriddenRequestURI, decodedFormData.result);
            response = sendResubmitRequest(client, postRequest);
        } catch (IOException e) {
            log.warn("Unable to resubmit form to {}" + System.lineSeparator()
                    + "perhaps set org.apache.shiro.form-resubmit-host or "
                    + "org.apache.shiro.form-resubmit-port system property?", overriddenRequestURI, e);
            return savedRequest;
        }
        if (rememberedAjaxResubmit && !decodedFormData.isStatelessRequest) {
            HttpRequest redirectRequest = constructPostRequest(overriddenRequestURI, savedFormData);
            var redirectResponse = client.send(redirectRequest, HttpResponse.BodyHandlers.ofString());
            log.debug("Redirect request: {}, response: {}", redirectRequest, redirectResponse);
            return processResubmitResponse(redirectResponse, originalRequest, originalResponse,
                    response.headers(), savedRequest, servletContext, true, rememberedAjaxResubmit);
        } else {
            deleteCookie(originalResponse, servletContext, SHIRO_FORM_DATA_KEY);
            return processResubmitResponse(response, originalRequest, originalResponse,
                    response.headers(), savedRequest, servletContext,
                    (rememberedAjaxResubmit && decodedFormData.isStatelessRequest) ? false
                            : decodedFormData.isPartialAjaxRequest, rememberedAjaxResubmit);
        }
    }
flash cookie is preserved here

@param request
@param response
@param path
@param paramValues
support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java