framework/web/Request.php
public function validateCsrfToken($clientSuppliedToken = null)
    {
        $method = $this->getMethod();
        // only validate CSRF token on non-"safe" methods https://tools.ietf.org/html/rfc2616#section-9.1.1
        if (!$this->enableCsrfValidation || in_array($method, ['GET', 'HEAD', 'OPTIONS'], true)) {
            return true;
        }

        $trueToken = $this->getCsrfToken();

        if ($clientSuppliedToken !== null) {
            return $this->validateCsrfTokenInternal($clientSuppliedToken, $trueToken);
        }

        return $this->validateCsrfTokenInternal($this->getBodyParam($this->csrfParam), $trueToken)
            || $this->validateCsrfTokenInternal($this->getCsrfTokenFromHeader(), $trueToken);
    }
public function validateCsrfToken($clientSuppliedToken = null)
    {
        $method = $this->getMethod();
        // only validate CSRF token on non-"safe" methods https://tools.ietf.org/html/rfc2616#section-9.1.1
        if (!$this->enableCsrfValidation || in_array($method, ['GET', 'HEAD', 'OPTIONS'], true)) {
            return true;
        }

        $trueToken = $this->getCsrfToken();

        if ($clientSuppliedToken !== null) {
            return $this->validateCsrfTokenInternal($clientSuppliedToken, $trueToken);
        }

        return $this->validateCsrfTokenInternal($this->getBodyParam($this->csrfParam), $trueToken)
            || $this->validateCsrfTokenInternal($this->getCsrfTokenFromHeader(), $trueToken);
    }
public function validateCsrfToken ( $ clientSuppliedToken = null ) { $ method = $ this -> getMethod ( ) ; // only validate CSRF token on non-"safe" methods https://tools.ietf.org/html/rfc2616#section-9.1.1 if ( ! $ this -> enableCsrfValidation || in_array ( $ method , [ 'GET' , 'HEAD' , 'OPTIONS' ] , true ) ) { return true ; } $ trueToken = $ this -> getCsrfToken ( ) ; if ( $ clientSuppliedToken !== null ) { return $ this -> validateCsrfTokenInternal ( $ clientSuppliedToken , $ trueToken ) ; } return $ this -> validateCsrfTokenInternal ( $ this -> getBodyParam ( $ this -> csrfParam ) , $ trueToken ) || $ this -> validateCsrfTokenInternal ( $ this -> getCsrfTokenFromHeader ( ) , $ trueToken ) ; }
Performs the CSRF validation.

This method will validate the user-provided CSRF token by comparing it with the one stored in cookie or session.
This method is mainly called in [[Controller::beforeAction()]].

Note that the method will NOT perform CSRF validation if [[enableCsrfValidation]] is false or the HTTP method
is among GET, HEAD or OPTIONS.

@param string $clientSuppliedToken the user-provided CSRF token to be validated. If null, the token will be retrieved from
the [[csrfParam]] POST field or HTTP header.
This parameter is available since version 2.0.4.
@return bool whether CSRF token is valid. If [[enableCsrfValidation]] is false, this method will return true.
Performs the CSRF validation .