src/Web/RequestHelper.php
public function getCsrfToken($regenerate = false)
    {
        if ($this->_csrfToken === null || $regenerate) {
            $token = $this->loadCsrfToken();
            if ($regenerate || empty($token)) {
                $token = $this->generateCsrfToken();
            }
            $this->_csrfToken = Reaction::$app->security->maskToken($token);
        }

        return $this->_csrfToken;
    }
public function getCsrfToken($regenerate = false)
    {
        if ($this->_csrfToken === null || $regenerate) {
            $token = $this->loadCsrfToken();
            if ($regenerate || empty($token)) {
                $token = $this->generateCsrfToken();
            }
            $this->_csrfToken = Reaction::$app->security->maskToken($token);
        }

        return $this->_csrfToken;
    }
Returns the token used to perform CSRF validation.

This token is generated in a way to prevent [BREACH attacks](http://breachattack.com/). It may be passed
along via a hidden field of an HTML form or an HTTP header value to support CSRF validation.
@param bool $regenerate whether to regenerate CSRF token. When this parameter is true, each time
this method is called, a new CSRF token will be generated and persisted (in session or cookie).
@return string the token used to perform CSRF validation.