diff --git a/src/Yesod/Transloadit.hs b/src/Yesod/Transloadit.hs
--- a/src/Yesod/Transloadit.hs
+++ b/src/Yesod/Transloadit.hs
@@ -55,6 +55,7 @@
 import           Text.Julius
 import           Yesod                         hiding (Key)
 import           Yesod.Form.Jquery             (YesodJquery (..))
+import           Yesod.Transloadit.Internal
 import           Yesod.Transloadit.OrderedJSON hiding (encode)
 import qualified Yesod.Transloadit.OrderedJSON as OJ
 #if MIN_VERSION_time(1,5,0)
@@ -165,7 +166,7 @@
   d <- runInputPost $ TransloaditResponse <$> ireq hiddenField "transloadit"
                                           <*> ireq hiddenField "_token"
   t <- tokenText
-  return $ if token d == t then return (raw d) else Nothing
+  return $ if csrfMatches (token d) t then pure (raw d) else Nothing
 
 _stepResult :: Getter Object (Maybe StepResult)
 _stepResult = to parseResult
diff --git a/src/Yesod/Transloadit/Internal.hs b/src/Yesod/Transloadit/Internal.hs
new file mode 100644
--- /dev/null
+++ b/src/Yesod/Transloadit/Internal.hs
@@ -0,0 +1,6 @@
+module Yesod.Transloadit.Internal where
+
+import           Data.Text
+
+csrfMatches :: Text -> Text -> Bool
+csrfMatches x y = x == y && x /= mempty
diff --git a/test/Tests.hs b/test/Tests.hs
--- a/test/Tests.hs
+++ b/test/Tests.hs
@@ -14,10 +14,11 @@
 import           Network.URI
 import           System.Locale
 import           Test.Hspec
-import           Yesod             hiding (Key, get)
-import           Yesod.Form.Jquery (YesodJquery (..))
+import           Yesod                      hiding (Key, get)
+import           Yesod.Form.Jquery          (YesodJquery (..))
 import           Yesod.Test
 import           Yesod.Transloadit
+import           Yesod.Transloadit.Internal
 
 data Test = Test
 mkYesod "Test" [parseRoutes| / HomeR GET |]
@@ -90,5 +91,9 @@
     yit "grabs mime" $ assertEqual "mime" (sampleResult ^. mime) (parseMIMEType "text/plain")
     yit "grabs field" $ assertEqual "field" (sampleResult ^. field) ("f" :: Text)
     yit "grabs url" $ assertEqual "url" (sampleResult ^. url) (parseURI "http://foo.com")
+  ydescribe "csrf checking" $ do
+    yit "fails with empties" $ assertEqual "empty csrf" False (csrfMatches "" "")
+    yit "fails with mismatches" $ assertEqual "bad csrf" False (csrfMatches "foo" "bar")
+    yit "succeeds" $ assertEqual "correct csrf" True (csrfMatches "foo" "foo")
 
 main = hspec formGenSpecs
diff --git a/yesod-transloadit.cabal b/yesod-transloadit.cabal
--- a/yesod-transloadit.cabal
+++ b/yesod-transloadit.cabal
@@ -1,5 +1,5 @@
 name:                yesod-transloadit
-version:             0.7.0.0
+version:             0.7.1.0
 synopsis:            Transloadit support for Yesod
 description:         Drop in Transloadit capabilites for Yesod web apps
 license:             MIT
@@ -16,7 +16,7 @@
   location: https://github.com/bobjflong/yesod-transloadit.git
 
 library
-  exposed-modules:     Yesod.Transloadit
+  exposed-modules:     Yesod.Transloadit, Yesod.Transloadit.Internal
   ghc-options:         -Wall
   other-modules:       Yesod.Transloadit.OrderedJSON
   build-depends:       base < 5