code: private function validateCsrfTokenInternal($token, $trueToken)
      {
          $token = base64_decode(str_replace('.', '+', $token));
          $n = StringHelper::byteLength($token);
          if ($n <= static::CSRF_MASK_LENGTH) {
              return false;
          }
          $mask = StringHelper::byteSubstr($token, 0, static::CSRF_MASK_LENGTH);
          $token = StringHelper::byteSubstr($token, static::CSRF_MASK_LENGTH, $n - static::CSRF_MASK_LENGTH);
          $token = $this->xorTokens($mask, $token);
  
          return $token === $trueToken;
      }
docs: Validates CSRF token
  
  @param string $token
  @param string $trueToken
  @return boolean