code: private function validateCsrfTokenInternal($clientSuppliedToken, $trueToken)
      {
          if (!is_string($clientSuppliedToken)) {
              return false;
          }
  
          $security = Yii::$app->security;
  
          return $security->compareString($security->unmaskToken($clientSuppliedToken), $security->unmaskToken($trueToken));
      }
docs: Validates CSRF token.
  
  @param string $clientSuppliedToken The masked client-supplied token.
  @param string $trueToken The masked true token.
  @return bool