code: public function validateCsrfToken($clientSuppliedToken = null)
      {
          $method = $this->getMethod();
          // only validate CSRF token on non-"safe" methods https://tools.ietf.org/html/rfc2616#section-9.1.1
          if (!$this->enableCsrfValidation || in_array($method, ['GET', 'HEAD', 'OPTIONS'], true)) {
              return true;
          }
  
          $trueToken = $this->getCsrfToken();
  
          if ($clientSuppliedToken !== null) {
              return $this->validateCsrfTokenInternal($clientSuppliedToken, $trueToken);
          }
  
          return $this->validateCsrfTokenInternal($this->getBodyParam($this->csrfParam), $trueToken)
              || $this->validateCsrfTokenInternal($this->getCsrfTokenFromHeader(), $trueToken);
      }
docs: Performs the CSRF validation.
  
  This method will validate the user-provided CSRF token by comparing it with the one stored in cookie or session.
  This method is mainly called in [[Controller::beforeAction()]].
  
  Note that the method will NOT perform CSRF validation if [[enableCsrfValidation]] is false or the HTTP method
  is among GET, HEAD or OPTIONS.
  
  @param string $clientSuppliedToken the user-provided CSRF token to be validated. If null, the token will be retrieved from
  the [[csrfParam]] POST field or HTTP header.
  This parameter is available since version 2.0.4.
  @return bool whether CSRF token is valid. If [[enableCsrfValidation]] is false, this method will return true.