fix: CSRF flow ships the raw token, not the HMAC cookie

2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
@@ -37,6 +37,7 @@ final class FullFlowTest extends TestCase

            // Step 2: POST team editor.
            $_COOKIE['__csrf'] = $cookie;
+            $_COOKIE['__csrf_token'] = $token;
            $_SERVER['REQUEST_METHOD'] = 'POST';
            $_SERVER['REQUEST_URI'] = '/scenarios/demo/edit/team';
            $_SERVER['CONTENT_TYPE'] = 'application/x-www-form-urlencoded';
@@ -104,6 +105,7 @@ final class FullFlowTest extends TestCase
        try {
            [$token, $cookie] = CsrfToken::issue(self::SECRET);
            $_COOKIE['__csrf'] = $cookie;
+            $_COOKIE['__csrf_token'] = $token;
            $_SERVER['REQUEST_METHOD'] = 'POST';
            $_SERVER['REQUEST_URI'] = '/assets/upload';
            $_SERVER['CONTENT_TYPE'] = 'multipart/form-data; boundary=----test';