The CSRF token is sent to the server from the HTML AND from the cookie. The server then performs mathematical operations on these two values and the result from each operation is compared with the result from the other, and if they are equal, then the token is the right one:

https://levelup.gitconnected.com/antiforgery-tokens-behind-the-scenes-dcddda54db8a