fix: CSRF flow ships the raw token, not the HMAC cookie

2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
@@ -47,7 +47,7 @@ final class MatchActionSupportTest extends TestCase
            match: $this->validMatchArray(),
            csrf: $csrf,
            turnToken: $badToken,
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
        );

        $result = $support->verify($request);
@@ -66,7 +66,7 @@ final class MatchActionSupportTest extends TestCase
            match: ['this' => 'is not a match'],
            csrf: $csrf,
            turnToken: 'whatever',
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
        );

        $result = $support->verify($request);