Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default.

This functionality is referenced in the security guide.

http://guides.rubyonrails.org/security.html#csrf-countermeas...