yii2: Yii2 (v 2.0.16-dev) Randomly fail to validate _csrf token on login.

What steps will reproduce the problem?

1. Application is Yii2 Advanced Template
2. On configurations have these settings:

'user' => [
            'identityClass' => 'backend\models\User',
            'enableAutoLogin' => false,
            'identityCookie' => [
                'name' => '_cookieBackend', // unique name
            ],
            'loginUrl' => ['site/login']
        ],

Also I have ‘cookieValidationKey’ property setted :

'components' => [
       'request' => [
           // !!! insert a secret key in the following (if it is empty) - this is required by cookie validation
           'cookieValidationKey' => 'SOMEKEY',
       ],
   ],

1. Creating form for Login with ActiveForm (method POST) and Login

What is the expected result?

Login in the application.

What do you get instead?

[yii\web\HttpException:400] yii\web\BadRequestHttpException: Unable to verify your data submission.

Additional info

Q	A
Yii version	2.0.16-dev
PHP version	5.6.30
Operating system

This issue appear Randomly, sometimes I can login successfully and sometimes not. On getting the error reload resolve the problem; I’m redirected inside the application and the user is logged. Disabling csrfValidation resolve the problem but it compromise the application security.

I dumped the function that validate the token:

/**
     * Validates CSRF token.
     *
     * @param string $clientSuppliedToken The masked client-supplied token.
     * @param string $trueToken The masked true token.
     * @return bool
     */
    private function validateCsrfTokenInternal($clientSuppliedToken, $trueToken)
    {
        if (!is_string($clientSuppliedToken)) {
            return false;
        }

        $security = Yii::$app->security;

        var_dump($security->unmaskToken($clientSuppliedToken));
        echo "<br \>";
        echo "<br \>";
        var_dump($security->unmaskToken($trueToken));
        echo "<br \>";
        echo "<br \>";
        var_dump($security->compareString($security->unmaskToken($clientSuppliedToken), $security->unmaskToken($trueToken)));
        die;
        
        return $security->compareString($security->unmaskToken($clientSuppliedToken), $security->unmaskToken($trueToken));
    }

In some cases variables $clientSuppliedToken and $trueToken have different values causing validateCsrfTokenInternal to return FALSE.

Also reporting this similar issue: 353181592