How do I test if Craft CSRF Protection is properly enabled?

Question

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?"

Let's say we pull that all off without a hitch. Our forms output the csrfTokenName and csrfToken and the browser cookie is generated just as expected.

Now, how do we test if it is actually working? Are there any steps an average, not-very-technical developer can take to see if CSRF protection is behaving as expected?

Answer 1

After the page loads with the form loads, delete the CSRF cookie, then submit the form. It should fail CSRF token validation.