vendor/symfony/security-http/EventListener/CsrfProtectionListener.php
line 35
Open in your IDE?