    public function testConfigurationCookieCreate()
    {
        $_SERVER['REQUEST_METHOD'] = 'GET';

        $controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
        $controller->request = new Request(['webroot' => '/dir/']);
        $controller->response = new Response();

        $component = new CsrfComponent($this->registry, [
            'cookieName' => 'token',
            'expiry' => '+1 hour',
            'secure' => true,
            'httpOnly' => true
        ]);

        $event = new Event('Controller.startup', $controller);
        $component->startup($event);

        $this->assertEmpty($controller->response->cookie('csrfToken'));
        $cookie = $controller->response->cookie('token');
        $this->assertNotEmpty($cookie, 'Should set a token.');
        $this->assertRegExp('/^[a-f0-9]+$/', $cookie['value'], 'Should look like a hash.');
        $this->assertWithinRange((new Time('+1 hour'))->format('U'), $cookie['expire'], 1, 'session duration.');
        $this->assertEquals('/dir/', $cookie['path'], 'session path.');
        $this->assertTrue($cookie['secure'], 'cookie security flag missing');
        $this->assertTrue($cookie['httpOnly'], 'cookie httpOnly flag missing');
    }
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.