diff --git a/core/modules/system/src/Form/FormTokenTest.php b/core/modules/system/src/Form/FormTokenTest.php
new file mode 100644
index 0000000..066a99c
--- /dev/null
+++ b/core/modules/system/src/Form/FormTokenTest.php
@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * @file
+ * Definition of Drupal\system\Tests\Form\FormTokenTest.
+ */
+
+namespace Drupal\system\Tests\FormTokenTest;
+
+use Drupal\simpletest\WebTestBase;
+
+class FormTokenTest extends WebTestBase {
+
+  public static function getInfo() {
+    return array(
+    'name' => 'Form token validation',
+    'description' => 'Tests validation of Form API tokens.',
+    'group' => 'Form API',
+    );
+  }
+
+  function setUp() {
+    parent::setUp(array('form_test', 'dblog'));
+    // We need to log in as form tokens aren't validated for anonymous users as
+    // they are shared in cached pages.
+    $this->web_user = $this->drupalCreateUser(array('access content'));
+    $this->drupalLogin($this->web_user);
+  }
+
+  /**
+   * Test that form submissions with an invalid token are rejected, with an
+   * error message shown to the user and logged to the watchdog.
+   */
+  function testInvalidFormToken() {
+    $this->drupalGet('form-test/input-forgery');
+    $edit = array('checkboxes[one]' => TRUE, 'form_token' => 'invalid_form_token');
+    $this->drupalPost(NULL, $edit, 'Submit');
+    $this->assertRaw(t('The form has become outdated. Copy any unsaved work in the form below and then <a href="@link">reload this page</a>.', array('@link' => url('form-test/input-forgery'))), t('Form submission with invalid form token displayed an error.'));
+      $watchdog_count = db_select('watchdog', 'w')
+        ->condition('w.type', 'system')
+        ->condition('w.message', 'Form token validation failed during form submission. %sent_token was sent, but %expected_token was expected. The form submission has been ignored.')
+        ->condition('w.variables', '%invalid_form_token%', 'LIKE')
+        ->countQuery()
+        ->execute()
+        ->fetchField();
+    $this->assertEqual(1, $watchdog_count, t('Form submission with invalid form token was logged to the watchdog.'));
+  }
+}