Global Protection
The engine verifies every unsafe request before it calls the controller action.
Send the token as _token or X-CSRF-Token. Safe methods do not require it.
CSRF Token
Current CSRF Token:
502ace1f87e06beecdacb029e49d20346dc0c808c7d0e41adc7c00270b09168e
Form with CSRF Protection
Blocked Form
The engine rejects this request before submit() runs.