src/Security/CSRF.php
public function getToken($action = null, $reuse = true)
    {
        $tokenStorage = $this->session->get(self::SESSION_KEY, []);

        $index = ($action) ? $action : self::DEFAULT_SELECTOR;
        
        if (!isset($tokenStorage[$index])) {
            $token = bin2hex(random_bytes(self::TOKEN_SIZE));
            $tokenStorage[$index] = array(
                'time' => time(),
                'token' => $token
            );
        } else {
            // Token already exists and is not expired
            $token = $tokenStorage[$index]['token'];
            
            // Update token time
            $tokenStorage[$index]['time'] = time();
        }
        
        $tokenStorage[$index]['reuse'] = $reuse;

        $key = bin2hex(random_bytes(self::TOKEN_SIZE));
        $tokenHMAC = $this->tokenHMAC($token, $key);

        $this->session->set(self::SESSION_KEY, $tokenStorage);

        return $key . self::TOKEN_DELIMTER . $tokenHMAC;
    }
public function getToken($action = null, $reuse = true)
    {
        $tokenStorage = $this->session->get(self::SESSION_KEY, []);

        $index = ($action) ? $action : self::DEFAULT_SELECTOR;
        
        if (!isset($tokenStorage[$index])) {
            $token = bin2hex(random_bytes(self::TOKEN_SIZE));
            $tokenStorage[$index] = array(
                'time' => time(),
                'token' => $token
            );
        } else {
            // Token already exists and is not expired
            $token = $tokenStorage[$index]['token'];
            
            // Update token time
            $tokenStorage[$index]['time'] = time();
        }
        
        $tokenStorage[$index]['reuse'] = $reuse;

        $key = bin2hex(random_bytes(self::TOKEN_SIZE));
        $tokenHMAC = $this->tokenHMAC($token, $key);

        $this->session->set(self::SESSION_KEY, $tokenStorage);

        return $key . self::TOKEN_DELIMTER . $tokenHMAC;
    }
Retrieve a token for the specified action
@param string $action An action the token is associated with
@param bool $reuse Is the token valid for multiple submissions
@return string Token string