Fixes #15496: CSRF token is now regenerated on changing identity

framework/CHANGELOG.md

@@ -3,6 +3,8 @@ Yii Framework 2 Change Log
 
 2.0.14 under development
 ------------------------
+
+- Enh #15496: CSRF token is now regenerated on changing identity (samdark, rhertogh)
 - Enh #15417: Added `yii\validators\FileValidator::$minFiles` (vladis84)
 - Bug #8983: Only truncate the original log file for rotation (matthewyang, developeruz)
 - Bug #14157: Add support for loading default value `CURRENT_TIMESTAMP` of MySQL `datetime` field (rossoneri)

framework/web/User.php

@@ -641,6 +641,9 @@ class User extends Component
                 $this->sendIdentityCookie($identity, $duration);
             }
         }
+
+        // regenerate CSRF token
+        Yii::$app->getRequest()->getCsrfToken(true);
     }
 
     /**

tests/framework/helpers/UrlTest.php

@@ -29,6 +29,7 @@ class UrlTest extends TestCase
             'components' => [
                 'request' => [
                     'class' => 'yii\web\Request',
+                    'cookieValidationKey' => '123',
                     'scriptUrl' => '/base/index.php',
                     'hostInfo' => 'http://example.com/',
                     'url' => '/base/index.php&r=site%2Fcurrent&id=42',