diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index bb7034f..b067502 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -546,9 +546,6 @@ public function processForm($form_id, &$form, FormStateInterface &$form_state) {
       if (!isset($input['form_id'])) {
         $input['form_id'] = $form_id;
       }
-      if (!isset($input['form_token']) && isset($form['#token'])) {
-        $input['form_token'] = $this->csrfToken->get($form['#token']);
-      }
       $form_state->setUserInput($input);
     }
 
@@ -700,13 +697,9 @@ public function prepareForm($form_id, &$form, FormStateInterface &$form_state) {
       $form['#method'] = 'get';
     }
 
-    // GET forms should not use a CSRF token.
+    // GET forms should be prevented from getting a CSRF Token.
     if (isset($form['#method']) && $form['#method'] === 'get') {
-      // Merges in a default, this means if you've explicitly set #token to the
-      // the $form_id on a GET form, which we don't recommend, it will work.
-      $form += [
-        '#token' => FALSE,
-      ];
+      unset($form['#token']);
     }
 
     // Generate a new #build_id for this form, if none has been set already.