diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c32f51..3b20ac4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## 2.2.4 under development
 
+- New #100: Add `CsrfTokenCookieMiddleware` that publishes the current CSRF token in a JavaScript-readable
+  response cookie for the cookie-to-header pattern (@vjik)
 - Enh #82: Explicitly import classes and functions in "use" section (@mspirkov)
 - Enh #83: Remove unnecessary files from Composer package (@mspirkov)
 
diff --git a/README.md b/README.md
index ba66755..97c3028 100644
--- a/README.md
+++ b/README.md
@@ -572,6 +572,89 @@ let response = fetch('https://api.example.com/whoami', {
 });
 ```
 
+#### Publishing the CSRF token in a cookie
+
+Instead of a dedicated endpoint, `CsrfTokenCookieMiddleware` publishes the current token in a JavaScript-readable cookie
+on every response. SPA HTTP clients such as [Axios](https://axios-http.com/docs/req_config) and [Inertia](https://inertiajs.com/csrf-protection)
+read this cookie automatically and send it back in a request header.
+
+The middleware only writes the cookie. Token validation stays the responsibility of `CsrfTokenMiddleware`, and the token
+from the request cookie is never trusted as proof — the submitted value is always taken from the request header or body
+parameter.
+
+Add `CsrfTokenCookieMiddleware` to the stack before `CsrfTokenMiddleware`. It decorates the response returned by
+the inner handlers, so this placement lets it publish the token even when `CsrfTokenMiddleware` rejects the request
+with `422 Unprocessable Entity` and a stale SPA can recover with the fresh value.
+
+Every cookie attribute is set through the constructor. By default, the cookie is named `XSRF-TOKEN`, is available for
+the `/` path, has no `Domain`, and is marked `SameSite=Lax`. The `Secure` attribute defaults to `null`, which means it
+is resolved per request from the request URI scheme (`Secure` is added when the scheme is `https`). It is **not**
+`HttpOnly`, so that the frontend can read it.
+
+```php
+$middleware = new CsrfTokenCookieMiddleware(
+    $csrfToken,
+    'XSRF-TOKEN',
+    '/',
+    null,
+    null,
+    CsrfTokenCookieMiddleware::SAME_SITE_LAX,
+    true,
+);
+```
+
+A `Set-Cookie` header does not by itself prevent a response from being cached
+([RFC 9111 section 7.3](https://www.rfc-editor.org/rfc/rfc9111#section-7.3)), so a response that publishes the token
+may be cached and later replay a stale token, or end up in a shared (proxy or CDN) cache and hand one user's token to
+another. The last constructor argument controls the `Cache-Control` response header:
+
+- `true` (default) — set `Cache-Control` to `no-store`, replacing any existing value (the middleware makes the
+  response user-specific, so a previously cacheable `Cache-Control` is no longer safe);
+- `false` — leave the header untouched (use this when the application already manages caching for these responses);
+- a string — set `Cache-Control` to that exact value, for example `'private'`.
+
+For example, Axios and Inertia send the token back in the `X-XSRF-TOKEN` header, so set the same name
+on `CsrfTokenMiddleware`:
+
+```php
+$csrfTokenMiddleware = $csrfTokenMiddleware->withHeaderName('X-XSRF-TOKEN');
+```
+
+In a Yii application, add both middlewares to the [`MiddlewareDispatcher`](https://github.com/yiisoft/middleware-dispatcher)
+configuration:
+
+```php
+use Yiisoft\Csrf\CsrfTokenCookieMiddleware;
+use Yiisoft\Csrf\CsrfTokenMiddleware;
+
+$middlewareDispatcher = $middlewareDispatcher->withMiddlewares([
+    ErrorCatcher::class,
+    SessionMiddleware::class,
+    CsrfTokenCookieMiddleware::class, // <-- add this (uses the default cookie settings)
+    [
+        'class' => CsrfTokenMiddleware::class,
+        'withHeaderName()' => ['X-XSRF-TOKEN'],
+    ],
+    Router::class,
+]);
+```
+
+To customize the cookie, replace `CsrfTokenCookieMiddleware::class` with an array definition:
+
+```php
+[
+    'class' => CsrfTokenCookieMiddleware::class,
+    '__construct()' => [
+        'cookieName' => 'XSRF-TOKEN',
+        'path' => '/',
+        'domain' => null,
+        'secure' => null,
+        'sameSite' => CsrfTokenCookieMiddleware::SAME_SITE_LAX,
+        'cacheControl' => true,
+    ],
+],
+```
+
 ## Documentation
 
 - [Internals](docs/internals.md)
diff --git a/src/CsrfTokenCookieMiddleware.php b/src/CsrfTokenCookieMiddleware.php
new file mode 100644
index 0000000..501e6cc
--- /dev/null
+++ b/src/CsrfTokenCookieMiddleware.php
@@ -0,0 +1,195 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Yiisoft\Csrf;
+
+use InvalidArgumentException;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+use Yiisoft\Http\Header;
+
+use function gettype;
+use function implode;
+use function in_array;
+use function is_bool;
+use function is_string;
+use function preg_match;
+use function rawurlencode;
+use function sprintf;
+
+/**
+ * PSR-15 middleware that publishes the current CSRF token in a JavaScript-readable response cookie.
+ *
+ * It is intended for AJAX/SPA clients that read the token from a cookie and send it back explicitly in a request
+ * header (the "cookie-to-header" pattern), for example Inertia and Axios which use the `XSRF-TOKEN` cookie and the
+ * `X-XSRF-TOKEN` header.
+ *
+ * The middleware only writes the cookie. Token validation stays the responsibility of {@see CsrfTokenMiddleware},
+ * which reads the submitted token from a header or a body parameter. Place this middleware before
+ * {@see CsrfTokenMiddleware} in the stack, so the cookie is published even on a rejected request.
+ *
+ * A `Set-Cookie` header does not by itself prevent a response from being cached (RFC 9111 section 7.3). A cached
+ * response may replay a stale token, or reach a shared (proxy or CDN) cache and hand one user's token to another. By
+ * default the middleware guards against this by setting `Cache-Control: no-store` on every response it touches; see
+ * the `$cacheControl` constructor parameter to change or disable this.
+ *
+ * @link https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#alternative-using-a-double-submit-cookie-pattern
+ * @link https://www.rfc-editor.org/rfc/rfc9111#section-7.3
+ */
+final class CsrfTokenCookieMiddleware implements MiddlewareInterface
+{
+    public const COOKIE_NAME = 'XSRF-TOKEN';
+
+    public const SAME_SITE_LAX = 'Lax';
+    public const SAME_SITE_STRICT = 'Strict';
+    public const SAME_SITE_NONE = 'None';
+
+    /**
+     * Control characters (including CR and LF) and the `;` attribute separator. These would let a configured
+     * cookie name, path or domain inject extra attributes or split the response header. Whether the values are
+     * otherwise well-formed is left to the caller.
+     */
+    private const PATTERN_HEADER_INJECTION = '/[\x00-\x1F\x7F\x3B]/';
+
+    private CsrfTokenInterface $token;
+    private string $cookieName;
+    private string $path;
+    private ?string $domain;
+    private ?bool $secure;
+    private ?string $sameSite;
+
+    /**
+     * @var bool|string
+     */
+    private $cacheControl;
+
+    /**
+     * The cookie name, path and domain are checked only for control characters and `;` to prevent response header
+     * injection; making sure they are otherwise valid is up to the caller.
+     *
+     * @param CsrfTokenInterface $token The CSRF token to publish.
+     * @param string $cookieName The name of the cookie holding the token.
+     * @param string $path The `Path` attribute of the cookie.
+     * @param string|null $domain The `Domain` attribute of the cookie, or `null` to omit it.
+     * @param bool|null $secure Whether the cookie should only be sent over HTTPS. A non-null value is used as given.
+     * When `null`, it is resolved automatically: `true` for `self::SAME_SITE_NONE` (browsers require `Secure` for such
+     * cookies), otherwise from the request URI scheme (`true` when the scheme is `https`).
+     * @param string|null $sameSite The `SameSite` attribute of the cookie: one of `self::SAME_SITE_LAX`,
+     * `self::SAME_SITE_STRICT`, `self::SAME_SITE_NONE`, or `null` to omit it. When `self::SAME_SITE_NONE` is used,
+     * `$secure` must not be `false`.
+     * @param bool|string $cacheControl How to handle the `Cache-Control` response header: `true` to set it to
+     * `no-store` (keeping the published token out of any cache), `false` to leave the header untouched, or a string
+     * to set it to that exact value. `true` and a string value replace an existing `Cache-Control`.
+     *
+     * @throws InvalidArgumentException When a cookie attribute or the `$cacheControl` argument is not valid.
+     */
+    public function __construct(
+        CsrfTokenInterface $token,
+        string $cookieName = self::COOKIE_NAME,
+        string $path = '/',
+        ?string $domain = null,
+        ?bool $secure = null,
+        ?string $sameSite = self::SAME_SITE_LAX,
+        $cacheControl = true
+    ) {
+        if (preg_match(self::PATTERN_HEADER_INJECTION, $cookieName)) {
+            throw new InvalidArgumentException(
+                sprintf('The cookie name "%s" contains invalid characters.', $cookieName),
+            );
+        }
+
+        if (preg_match(self::PATTERN_HEADER_INJECTION, $path)) {
+            throw new InvalidArgumentException(
+                sprintf('The cookie path "%s" contains invalid characters.', $path),
+            );
+        }
+
+        if ($domain !== null && preg_match(self::PATTERN_HEADER_INJECTION, $domain)) {
+            throw new InvalidArgumentException(
+                sprintf('The cookie domain "%s" contains invalid characters.', $domain),
+            );
+        }
+
+        $allowedSameSite = [self::SAME_SITE_LAX, self::SAME_SITE_STRICT, self::SAME_SITE_NONE];
+        if ($sameSite !== null && !in_array($sameSite, $allowedSameSite, true)) {
+            throw new InvalidArgumentException(
+                sprintf('The "SameSite" attribute value "%s" is not valid.', $sameSite),
+            );
+        }
+
+        if ($sameSite === self::SAME_SITE_NONE && $secure === false) {
+            throw new InvalidArgumentException(
+                'The "secure" flag is required for cookies with "SameSite" attribute set to "None".',
+            );
+        }
+
+        /**
+         * The parameter has no native type because a `bool|string` union is not available on PHP 7.4, so a value of
+         * any other type can still be passed at runtime. Once the minimum PHP version is 8.0+, type the parameter as
+         * `bool|string` and remove this check together with the suppression below.
+         *
+         * @psalm-suppress DocblockTypeContradiction
+         */
+        if (!is_bool($cacheControl) && !is_string($cacheControl)) {
+            throw new InvalidArgumentException(
+                sprintf('The "cacheControl" argument must be a bool or a string, "%s" given.', gettype($cacheControl)),
+            );
+        }
+
+        $this->token = $token;
+        $this->cookieName = $cookieName;
+        $this->path = $path;
+        $this->domain = $domain;
+        $this->secure = $secure;
+        $this->sameSite = $sameSite;
+        $this->cacheControl = $cacheControl;
+    }
+
+    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
+    {
+        $response = $handler->handle($request);
+
+        $response = $response->withAddedHeader(Header::SET_COOKIE, $this->buildCookieHeaderValue($request));
+
+        return $this->applyCacheControl($response);
+    }
+
+    private function buildCookieHeaderValue(ServerRequestInterface $request): string
+    {
+        $secure = $this->secure
+            ?? ($this->sameSite === self::SAME_SITE_NONE || $request->getUri()->getScheme() === 'https');
+
+        $parts = [$this->cookieName . '=' . rawurlencode($this->token->getValue())];
+
+        if ($this->domain !== null) {
+            $parts[] = 'Domain=' . $this->domain;
+        }
+
+        $parts[] = 'Path=' . $this->path;
+
+        if ($secure) {
+            $parts[] = 'Secure';
+        }
+
+        if ($this->sameSite !== null) {
+            $parts[] = 'SameSite=' . $this->sameSite;
+        }
+
+        return implode('; ', $parts);
+    }
+
+    private function applyCacheControl(ResponseInterface $response): ResponseInterface
+    {
+        if ($this->cacheControl === false) {
+            return $response;
+        }
+
+        return $response->withHeader(
+            Header::CACHE_CONTROL,
+            $this->cacheControl === true ? 'no-store' : $this->cacheControl,
+        );
+    }
+}
diff --git a/src/StubCsrfToken.php b/src/StubCsrfToken.php
index 6c21f34..8067fdf 100644
--- a/src/StubCsrfToken.php
+++ b/src/StubCsrfToken.php
@@ -18,9 +18,7 @@ final class StubCsrfToken implements CsrfTokenInterface
 
     public function __construct(?string $token = null)
     {
-        if (null === $token) {
-            $token = Random::string();
-        }
+        $token ??= Random::string();
         $this->token = $token;
     }
 
diff --git a/tests/ConfigTest.php b/tests/ConfigTest.php
index 690bb30..4b3a0a0 100644
--- a/tests/ConfigTest.php
+++ b/tests/ConfigTest.php
@@ -43,9 +43,7 @@ private function createContainer(?array $params = null): Container
 
     private function getDiConfig(?array $params = null): array
     {
-        if ($params === null) {
-            $params = $this->getParams();
-        }
+        $params ??= $this->getParams();
         return require dirname(__DIR__) . '/config/di-web.php';
     }
 
diff --git a/tests/CsrfTokenCookieMiddlewareTest.php b/tests/CsrfTokenCookieMiddlewareTest.php
new file mode 100644
index 0000000..3dd4799
--- /dev/null
+++ b/tests/CsrfTokenCookieMiddlewareTest.php
@@ -0,0 +1,381 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Yiisoft\Csrf\Tests;
+
+use InvalidArgumentException;
+use Nyholm\Psr7\Response;
+use Nyholm\Psr7\ServerRequest;
+use PHPUnit\Framework\TestCase;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+use Yiisoft\Csrf\CsrfTokenCookieMiddleware;
+use Yiisoft\Csrf\StubCsrfToken;
+use Yiisoft\Http\Method;
+
+use function sprintf;
+
+final class CsrfTokenCookieMiddlewareTest extends TestCase
+{
+    /**
+     * @dataProvider dataHeaderInjection
+     */
+    public function testCookieNameWithHeaderInjection(string $cookieName): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage(
+            sprintf('The cookie name "%s" contains invalid characters.', $cookieName),
+        );
+
+        new CsrfTokenCookieMiddleware(new StubCsrfToken(), $cookieName);
+    }
+
+    /**
+     * @dataProvider dataHeaderInjection
+     */
+    public function testCookiePathWithHeaderInjection(string $path): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage(
+            sprintf('The cookie path "%s" contains invalid characters.', $path),
+        );
+
+        new CsrfTokenCookieMiddleware(new StubCsrfToken(), 'XSRF-TOKEN', $path);
+    }
+
+    /**
+     * @dataProvider dataHeaderInjection
+     */
+    public function testCookieDomainWithHeaderInjection(string $domain): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage(
+            sprintf('The cookie domain "%s" contains invalid characters.', $domain),
+        );
+
+        new CsrfTokenCookieMiddleware(new StubCsrfToken(), 'XSRF-TOKEN', '/', $domain);
+    }
+
+    public function dataHeaderInjection(): array
+    {
+        return [
+            'semicolon' => ['a; Secure'],
+            'newline' => ["a\nSet-Cookie: b=c"],
+            'carriage return' => ["a\rb"],
+            'null byte' => ["a\x00b"],
+        ];
+    }
+
+    public function testInvalidSameSite(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('The "SameSite" attribute value "Weak" is not valid.');
+
+        new CsrfTokenCookieMiddleware(new StubCsrfToken(), 'XSRF-TOKEN', '/', null, true, 'Weak');
+    }
+
+    public function testSameSiteNoneWithoutSecure(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage(
+            'The "secure" flag is required for cookies with "SameSite" attribute set to "None".',
+        );
+
+        new CsrfTokenCookieMiddleware(
+            new StubCsrfToken(),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            false,
+            CsrfTokenCookieMiddleware::SAME_SITE_NONE,
+        );
+    }
+
+    public function testDefaults(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $response = $middleware->process($this->createServerRequest(), $this->createRequestHandler());
+
+        $this->assertSame(
+            ['XSRF-TOKEN=test-token; Path=/; Secure; SameSite=Lax'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    /**
+     * @dataProvider dataSameSiteNoneAlwaysGetsSecure
+     */
+    public function testSameSiteNoneAlwaysGetsSecure(string $uri): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(
+            new StubCsrfToken('test-token'),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            null,
+            CsrfTokenCookieMiddleware::SAME_SITE_NONE,
+        );
+
+        $response = $middleware->process(
+            $this->createServerRequest(Method::GET, $uri),
+            $this->createRequestHandler(),
+        );
+
+        $this->assertSame(
+            ['XSRF-TOKEN=test-token; Path=/; Secure; SameSite=None'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function dataSameSiteNoneAlwaysGetsSecure(): array
+    {
+        return [
+            'https' => ['https://example.com/'],
+            'http' => ['http://example.com/'],
+        ];
+    }
+
+    public function dataSecureIsResolvedFromRequestScheme(): array
+    {
+        return [
+            'https' => ['https://example.com/', 'XSRF-TOKEN=test-token; Path=/; Secure; SameSite=Lax'],
+            'http' => ['http://example.com/', 'XSRF-TOKEN=test-token; Path=/; SameSite=Lax'],
+        ];
+    }
+
+    /**
+     * @dataProvider dataSecureIsResolvedFromRequestScheme
+     */
+    public function testSecureIsResolvedFromRequestScheme(string $uri, string $expectedCookie): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $response = $middleware->process(
+            $this->createServerRequest(Method::GET, $uri),
+            $this->createRequestHandler(),
+        );
+
+        $this->assertSame([$expectedCookie], $response->getHeader('Set-Cookie'));
+    }
+
+    public function testExplicitSecureTakesPrecedenceOverRequestScheme(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(
+            new StubCsrfToken('test-token'),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            true,
+        );
+
+        $response = $middleware->process(
+            $this->createServerRequest(Method::GET, 'http://example.com/'),
+            $this->createRequestHandler(),
+        );
+
+        $this->assertSame(
+            ['XSRF-TOKEN=test-token; Path=/; Secure; SameSite=Lax'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function testCacheControlNoStoreIsAddedByDefault(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $response = $middleware->process($this->createServerRequest(), $this->createRequestHandler());
+
+        $this->assertSame(['no-store'], $response->getHeader('Cache-Control'));
+    }
+
+    public function testExistingCacheControlIsReplacedByDefault(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $requestHandler = $this->createMock(RequestHandlerInterface::class);
+        $requestHandler
+            ->method('handle')
+            ->willReturn((new Response())->withHeader('Cache-Control', 'public, max-age=3600'));
+
+        $response = $middleware->process($this->createServerRequest(), $requestHandler);
+
+        $this->assertSame(['no-store'], $response->getHeader('Cache-Control'));
+    }
+
+    public function testCacheControlIsNotTouchedWhenDisabled(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(
+            new StubCsrfToken('test-token'),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            null,
+            CsrfTokenCookieMiddleware::SAME_SITE_LAX,
+            false,
+        );
+
+        $response = $middleware->process($this->createServerRequest(), $this->createRequestHandler());
+
+        $this->assertFalse($response->hasHeader('Cache-Control'));
+    }
+
+    public function testCacheControlIsSetToExplicitValue(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(
+            new StubCsrfToken('test-token'),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            null,
+            CsrfTokenCookieMiddleware::SAME_SITE_LAX,
+            'private',
+        );
+
+        $requestHandler = $this->createMock(RequestHandlerInterface::class);
+        $requestHandler
+            ->method('handle')
+            ->willReturn((new Response())->withHeader('Cache-Control', 'public'));
+
+        $response = $middleware->process($this->createServerRequest(), $requestHandler);
+
+        $this->assertSame(['private'], $response->getHeader('Cache-Control'));
+    }
+
+    public function testInvalidCacheControl(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('The "cacheControl" argument must be a bool or a string, "integer" given.');
+
+        new CsrfTokenCookieMiddleware(
+            new StubCsrfToken(),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            null,
+            CsrfTokenCookieMiddleware::SAME_SITE_LAX,
+            123,
+        );
+    }
+
+    public function testTokenValueIsUrlEncoded(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('a b+c/d='));
+
+        $response = $middleware->process($this->createServerRequest(), $this->createRequestHandler());
+
+        $this->assertSame(
+            ['XSRF-TOKEN=a%20b%2Bc%2Fd%3D; Path=/; Secure; SameSite=Lax'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function testCustomAttributes(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(
+            new StubCsrfToken('test-token'),
+            'MY-TOKEN',
+            '/api',
+            'example.com',
+            false,
+            CsrfTokenCookieMiddleware::SAME_SITE_STRICT,
+        );
+
+        $response = $middleware->process($this->createServerRequest(), $this->createRequestHandler());
+
+        $this->assertSame(
+            ['MY-TOKEN=test-token; Domain=example.com; Path=/api; SameSite=Strict'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function testWithoutSameSite(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(
+            new StubCsrfToken('test-token'),
+            'XSRF-TOKEN',
+            '/',
+            null,
+            true,
+            null,
+        );
+
+        $response = $middleware->process($this->createServerRequest(), $this->createRequestHandler());
+
+        $this->assertSame(
+            ['XSRF-TOKEN=test-token; Path=/; Secure'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function testCookieIsPublishedForUnsafeMethods(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $response = $middleware->process(
+            $this->createServerRequest(Method::POST),
+            $this->createRequestHandler(),
+        );
+
+        $this->assertSame(
+            ['XSRF-TOKEN=test-token; Path=/; Secure; SameSite=Lax'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function testCookieIsPublishedOnFailureResponse(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $requestHandler = $this->createMock(RequestHandlerInterface::class);
+        $requestHandler
+            ->method('handle')
+            ->willReturn(new Response(422));
+
+        $response = $middleware->process($this->createServerRequest(Method::POST), $requestHandler);
+
+        $this->assertSame(422, $response->getStatusCode());
+        $this->assertSame(
+            ['XSRF-TOKEN=test-token; Path=/; Secure; SameSite=Lax'],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    public function testExistingResponseCookiesArePreserved(): void
+    {
+        $middleware = new CsrfTokenCookieMiddleware(new StubCsrfToken('test-token'));
+
+        $requestHandler = $this->createMock(RequestHandlerInterface::class);
+        $requestHandler
+            ->method('handle')
+            ->willReturn((new Response())->withAddedHeader('Set-Cookie', 'session=abc; Path=/'));
+
+        $response = $middleware->process($this->createServerRequest(), $requestHandler);
+
+        $this->assertSame(
+            [
+                'session=abc; Path=/',
+                'XSRF-TOKEN=test-token; Path=/; Secure; SameSite=Lax',
+            ],
+            $response->getHeader('Set-Cookie'),
+        );
+    }
+
+    private function createRequestHandler(): RequestHandlerInterface
+    {
+        $requestHandler = $this->createMock(RequestHandlerInterface::class);
+        $requestHandler
+            ->method('handle')
+            ->willReturn(new Response(200));
+
+        return $requestHandler;
+    }
+
+    private function createServerRequest(
+        string $method = Method::GET,
+        string $uri = 'https://example.com/'
+    ): ServerRequestInterface {
+        return new ServerRequest($method, $uri);
+    }
+}