src/Web/RequestHelper.php
protected function generateCsrfToken()
    {
        $token = Reaction::$app->security->generateRandomString();
        if ($this->enableCsrfCookie) {
            $cookie = $this->createCsrfCookie($token);
            $this->app->response->getCookies()->add($cookie);
        } else {
            $this->app->session->set($this->csrfParam, $token);
        }

        return $token;
    }
protected function generateCsrfToken()
    {
        $token = Reaction::$app->security->generateRandomString();
        if ($this->enableCsrfCookie) {
            $cookie = $this->createCsrfCookie($token);
            $this->app->response->getCookies()->add($cookie);
        } else {
            $this->app->session->set($this->csrfParam, $token);
        }

        return $token;
    }
Generates an unmasked random token used to perform CSRF validation.
@return string the random token for CSRF validation.