code: public function checkToken($string, $action = null, $tokenValidity = null)
      {
          // Get token data from session
          $index = ($action) ? $action : self::DEFAULT_SELECTOR;
          $tokenStorage = $this->session->get(self::SESSION_KEY, []);
          if (!isset($tokenStorage[$index])) {
              return false;
          }
          $tokenData = $tokenStorage[$index];
  
          // Check token expiration
          if ($this->isExpired($tokenData, $tokenValidity)) {
              $this->ivalidateToken($index, $tokenStorage);
              return false;
          }
          
          // Check correct format of received token
          $parts = explode(self::TOKEN_DELIMTER, $string);
          if (count($parts) !== 2) {
              return false;
          }
  
          // Validate the token
          $trueToken = $tokenData['token'];
          $key = $parts[0];           // A key used to create a keyed hash of the real token
          $tokenHMAC = $parts[1];     // Keyed hash of the real token
          $trueTokenHMAC = $this->tokenHMAC($trueToken, $key);
          $isValid = \hash_equals($trueTokenHMAC, $tokenHMAC);
          
          // Remove if it is a one-time token
          if ($isValid && !$tokenData['reuse']) {
              $this->ivalidateToken($index, $tokenStorage);
          }
          
          return $isValid;
      }
docs: Token validation
  @param string $string token string to be validated
  @param string $action action the validated token is associated with
  @return boolean true on successful validation