This method will validate the user-provided CSRF token by comparing it with the one stored in cookie or session.
This method is mainly called in [[Controller::beforeAction()]].
Note that the method will NOT perform CSRF validation if [[enableCsrfValidation]] is false or the HTTP method
is among GET, HEAD or OPTIONS.
public validateCsrfToken ( string $token = null ) : boolean | ||
$token | string | the user-provided CSRF token to be validated. If null, the token will be retrieved from the [[csrfParam]] POST field or HTTP header. This parameter is available since version 2.0.4. |
return | boolean | whether CSRF token is valid. If [[enableCsrfValidation]] is false, this method will return true. |