I know I can use the the Generate CSRF PoC feature to test whether I have a CSRF vulnerability but once I mitigate this, how will Burp recognize this fix on the next scan? I need to be able to demonstrate to the client that the vulnerability is no longer present by running a Burp scan.
For any CSRF issue, the general demonstration of prevention is showing that repeating the same request with the same preventative token, or with no preventative token, doesn't result in any data on the server changing.
Therefore, perform a legitimate request, send it to repeater, and try performing it again. If it works, the CSRF protection isn't working.
Then remove the CSRF token and send it again. If it works, the protection isn't working.