CSRF fails after relogin

[samdark]

1. Login.
2. Logout.
3. Try to login again.

Expected to log in. Got CSRF protection responding with "Unprocessable entity".

[TiaNex-Com]

the session or $this->session->get(''_csrf") was flushed after login

$this->session->set($this->name, $token); set session failed

very time when class csrf init with a new SessionInterface $session , the session is not the existed one,

[samdark]

Seems PHPSESSID cookie keeps its value after logout. If it's deleted, it works well.

[samdark]

Likely Session::destroy() is missing something.

[rustamwin]

It looks like SessionMiddleware is not working properly after yiisoft/yii-web@4876355

[samdark]

Likely. Want to dig it more?

[samdark]

yiisoft/yii-web#240

[TiaNex-Com]

thank you