src/Security/CSRF.php
public function checkToken($string, $action = null, $tokenValidity = null)
    {
        // Get token data from session
        $index = ($action) ? $action : self::DEFAULT_SELECTOR;
        $tokenStorage = $this->session->get(self::SESSION_KEY, []);
        if (!isset($tokenStorage[$index])) {
            return false;
        }
        $tokenData = $tokenStorage[$index];

        // Check token expiration
        if ($this->isExpired($tokenData, $tokenValidity)) {
            $this->ivalidateToken($index, $tokenStorage);
            return false;
        }
        
        // Check correct format of received token
        $parts = explode(self::TOKEN_DELIMTER, $string);
        if (count($parts) !== 2) {
            return false;
        }

        // Validate the token
        $trueToken = $tokenData['token'];
        $key = $parts[0];           // A key used to create a keyed hash of the real token
        $tokenHMAC = $parts[1];     // Keyed hash of the real token
        $trueTokenHMAC = $this->tokenHMAC($trueToken, $key);
        $isValid = \hash_equals($trueTokenHMAC, $tokenHMAC);
        
        // Remove if it is a one-time token
        if ($isValid && !$tokenData['reuse']) {
            $this->ivalidateToken($index, $tokenStorage);
        }
        
        return $isValid;
    }
public function checkToken($string, $action = null, $tokenValidity = null)
    {
        // Get token data from session
        $index = ($action) ? $action : self::DEFAULT_SELECTOR;
        $tokenStorage = $this->session->get(self::SESSION_KEY, []);
        if (!isset($tokenStorage[$index])) {
            return false;
        }
        $tokenData = $tokenStorage[$index];

        // Check token expiration
        if ($this->isExpired($tokenData, $tokenValidity)) {
            $this->ivalidateToken($index, $tokenStorage);
            return false;
        }
        
        // Check correct format of received token
        $parts = explode(self::TOKEN_DELIMTER, $string);
        if (count($parts) !== 2) {
            return false;
        }

        // Validate the token
        $trueToken = $tokenData['token'];
        $key = $parts[0];           // A key used to create a keyed hash of the real token
        $tokenHMAC = $parts[1];     // Keyed hash of the real token
        $trueTokenHMAC = $this->tokenHMAC($trueToken, $key);
        $isValid = \hash_equals($trueTokenHMAC, $tokenHMAC);
        
        // Remove if it is a one-time token
        if ($isValid && !$tokenData['reuse']) {
            $this->ivalidateToken($index, $tokenStorage);
        }
        
        return $isValid;
    }
Token validation
@param string $string token string to be validated
@param string $action action the validated token is associated with
@return boolean true on successful validation