protected function tokensMatch(ServerRequestInterface $request): bool
    {
        $sessionToken = $request->getAttribute('session')->getToken();
        $token        = $request->getAttribute('_token') ?? $request->getHeaderLine('x-csrf-token');
        $header       = $request->getHeaderLine('x-xsrf-token');

        if ($token === '' && $header !== '') {
            try {
                $key          = KeyFactory::loadEncryptionKey($this->manager->getConfig()['key_path']);
                $hiddenString = Crypto::decrypt($header, $key);
                $token        = $hiddenString->getString();
            } catch (InvalidMessage $exception) {
                $token = $header;
            }
        }

        if (! \is_string($sessionToken) || ! \is_string($token)) {
            return false;
        }

        return \hash_equals($sessionToken, $token);
    }