use Symfony\Bundle\FrameworkBundle\KernelBrowser;
use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
use Symfony\Component\BrowserKit\Cookie;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
use Symfony\Component\Security\Core\User\UserInterface;

abstract class AbstractWebTestCase extends WebTestCase
{
    private KernelBrowser $client;
    private SessionInterface $session;
    
    public function setUp(): void
    {
        parent::setUp();
        $this->client = static::createClient();
        ...
    }

    ...

    /**
     * This replicates static::createClient()->loginUser()
     * Inspect that method, as there are additional checks there that may be necessary for your use case.
     * The magic here is tracking an internal $session object that can be updated as needed.
     */
    protected function loginUser(UserInterface $user): void
    {	
        $token = new TestBrowserToken($user->getRoles(), $user, $firewallContext);
        $container = static::getContainer();
        $container->get('security.untracked_token_storage')->setToken($token);

	$this->session = $container->get('session.factory')->createSession();
        $this->setLoginSessionValue('_security_'.$firewallContext, serialize($token));

        $domains = array_unique(array_map(function (Cookie $cookie) {
            return $cookie->getName() === $this->session->getName() ? $cookie->getDomain() : '';
        }, $this->client->getCookieJar()->all())) ?: [''];
        
        foreach ($domains as $domain) {
            $cookie = new Cookie($this->session->getName(), $this->session->getId(), null, null, $domain);
            $this->client->getCookieJar()->set($cookie);
        }

        return $this;
    }

    /** @param mixed $value */
    protected function setLoginSessionValue(string $name, $value): self
    {
        if (isset($this->session)) {
            $this->session->set($name, $value);
            $this->session->save();
            return $this;
        }
        throw new \LogicException("loginUser() must be called to initialize session");
    }

    ...
}

use Symfony\Component\Security\Csrf\TokenStorage\SessionTokenStorage;

class MyWebTest extends AbstractWebTestCase
{
    public function testSomething(): void
    {
        $user = ...;
        $this->loginUser($user);
        
        // Technically, you don't need to generate a real token here, and instead could use any test string
        $tokenId = ...;
        $csrfToken = static::getContainer()->get('security.csrf.token_generator')->generateToken();
        $this->setLoginSessionValue(SessionTokenStorage::SESSION_NAMESPACE . "/$tokenId", $csrfToken);

        // Now you can make raw POST requests without crawling to the form page first!
    }
}