@@ -119,9 +119,33 @@ var _ = Describe("CSRF Cookie Tests", func() {
119119 Value: encoded,
120120 }
121121
122− _, _, valid := encryption.Validate(cookie, cookieOpts.Secret, cookieOpts.Expire)
122+ _, _, valid := encryption.Validate(cookie, cookieOpts.Secret, cookieOpts.CSRFExpire)
123123 Expect(valid).To(BeTrue())
124124 })
125+
126+ It("validates CSRF token using CSRFExpire when Expire is lower", func() {
127+ // Set Expire to be much lower than CSRFExpire
128+ cookieOpts.Expire = time.Second
129+ cookieOpts.CSRFExpire = time.Hour
130+
131+ privateCSRF.OAuthState = []byte(csrfState)
132+ privateCSRF.OIDCNonce = []byte(csrfNonce)
133+
134+ encoded, err := privateCSRF.encodeCookie()
135+ Expect(err).ToNot(HaveOccurred())
136+
137+ cookie := &http.Cookie{
138+ Name: privateCSRF.cookieName(),
139+ Value: encoded,
140+ }
141+
142+ // The cookie should still be valid even though Expire is only 1 second
143+ decoded, err := decodeCSRFCookie(cookie, cookieOpts)
144+ Expect(err).ToNot(HaveOccurred())
145+ Expect(decoded).ToNot(BeNil())
146+ Expect(decoded.OAuthState).To(Equal([]byte(csrfState)))
147+ Expect(decoded.OIDCNonce).To(Equal([]byte(csrfNonce)))
148+ })
125149 })
126150
127151 Context("Cookie Management", func() {