Global Protection
The engine verifies every unsafe request before it calls the controller action.
Send the token as _token or X-CSRF-Token. Safe methods do not require it.
CSRF Token
Current CSRF Token:
b000f7a8b6cd4c6d2b5a2f17e13fa4374283ee6f20f1d69b4e650a5f6ab8a3eb
Form with CSRF Protection
Blocked Form
The engine rejects this request before submit() runs.