code: public static function validate($strToken)
  	{
  		// The feature has been disabled
  		if (Config::get('disableRefererCheck') || \defined('BYPASS_TOKEN_CHECK'))
  		{
  			return true;
  		}
  
  		// Check against the whitelist (thanks to Tristan Lins) (see #3164)
  		if (Config::get('requestTokenWhitelist'))
  		{
  			$strHostname = gethostbyaddr($_SERVER['REMOTE_ADDR']);
  
  			foreach (Config::get('requestTokenWhitelist') as $strDomain)
  			{
  				if ($strDomain == $strHostname || preg_match('/\.' . preg_quote($strDomain, '/') . '$/', $strHostname))
  				{
  					return true;
  				}
  			}
  		}
  
  		$container = System::getContainer();
  
  		return $container->get('contao.csrf.token_manager')->isTokenValid(new CsrfToken($container->getParameter('contao.csrf_token_name'), $strToken));
  	}
docs: Validate a token
  
  @param string $strToken The request token
  
  @return boolean True if the token matches the stored one