diff --git a/core/misc/ajax.js b/core/misc/ajax.js
index f095043..fcda143 100644
--- a/core/misc/ajax.js
+++ b/core/misc/ajax.js
@@ -398,14 +398,14 @@
 
         // Prior to invoking the response's commands, verify that they can be
         // trusted by checking for a response header. See
-        // ajax_set_verification_header() for details.
+        // \Drupal\Core\EventSubscriber\AjaxResponseSubscriber for details.
         // - Empty responses are harmless so can bypass verification. This
         //   avoids an alert message for server-generated no-op responses that
         //   skip Ajax rendering.
         // - Ajax objects with trusted URLs (e.g., ones defined server-side via
-        //   #ajax) can bypass header verification. This is especially useful for
-        //   Ajax with multipart forms. Because IFRAME transport is used, the
-        //   response headers cannot be accessed for verification.
+        //   #ajax) can bypass header verification. This is especially useful
+        //   for Ajax with multipart forms. Because IFRAME transport is used,
+        //   the response headers cannot be accessed for verification.
         if (response !== null && !drupalSettings.urlIsAjaxTrusted[ajax.url]) {
           if (xmlhttprequest.getResponseHeader('X-Drupal-Ajax-Token') !== '1') {
             var customMessage = Drupal.t("The response failed verification so will not be processed.");
diff --git a/core/modules/simpletest/src/WebTestBase.php b/core/modules/simpletest/src/WebTestBase.php
index 97789bd..68a4b8b 100644
--- a/core/modules/simpletest/src/WebTestBase.php
+++ b/core/modules/simpletest/src/WebTestBase.php
@@ -71,6 +71,13 @@
   protected $curlHandle;
 
   /**
+   * Whether or not to assert the presence of the X-Drupal-Ajax-Token.
+   *
+   * @var bool
+   */
+  protected $assertAjaxHeader = TRUE;
+
+  /**
    * The headers of the page currently loaded in the internal browser.
    *
    * @var Array
@@ -1876,7 +1883,9 @@ protected function drupalPostAjaxForm($path, $edit, $triggering_element, $ajax_p
 
     // Submit the POST request.
     $return = Json::decode($this->drupalPostForm(NULL, $edit, array('path' => $ajax_path, 'triggering_element' => $triggering_element), $options, $headers, $form_html_id, $extra_post));
-    $this->assertIdentical($this->drupalGetHeader('X-Drupal-Ajax-Token'), '1', 'Ajax response header found.');
+    if ($this->assertAjaxHeader) {
+      $this->assertIdentical($this->drupalGetHeader('X-Drupal-Ajax-Token'), '1', 'Ajax response header found.');
+    }
 
     // Change the page content by applying the returned commands.
     if (!empty($ajax_settings) && !empty($return)) {
diff --git a/core/modules/system/src/Tests/Ajax/FormValuesTest.php b/core/modules/system/src/Tests/Ajax/FormValuesTest.php
index c8f164b..1010eef 100644
--- a/core/modules/system/src/Tests/Ajax/FormValuesTest.php
+++ b/core/modules/system/src/Tests/Ajax/FormValuesTest.php
@@ -48,6 +48,9 @@ function testSimpleAjaxFormValue() {
     // Verify that AJAX elements with invalid callbacks return error code 500.
     // Ensure the test error log is empty before these tests.
     $this->assertNoErrorsLogged();
+    // We don't need to check for the X-Drupal-Ajax-Token header with these
+    // invalid requests.
+    $this->assertAjaxHeader = FALSE;
     foreach (array('null', 'empty', 'nonexistent') as $key) {
       $element_name = 'select_' . $key . '_callback';
       $edit = array(
@@ -56,6 +59,8 @@ function testSimpleAjaxFormValue() {
       $commands = $this->drupalPostAjaxForm('ajax_forms_test_get_form', $edit, $element_name);
       $this->assertResponse(500);
     }
+    // Switch this back to the default.
+    $this->assertAjaxHeader = TRUE;
     // The exceptions are expected. Do not interpret them as a test failure.
     // Not using File API; a potential error must trigger a PHP warning.
     unlink(\Drupal::root() . '/' . $this->siteDirectory . '/error.log');