I am passing an empty body, and even in that case, validateCSRFToken able to validate the request. It should return false if the csrfToken value is not defined.