0, 'path' => '/', 'domain' => '', 'secure' => app_is_https(), 'httponly' => true, 'samesite' => 'Lax', ]); session_name(app_env('APP_SESSION_NAME', 'kaffeeliste_session') ?? 'kaffeeliste_session'); session_start(); } function app_csrf_token(): string { app_start_session(); if (!isset($_SESSION) || !is_array($_SESSION)) { $_SESSION = []; } if (empty($_SESSION['csrf_token']) || !is_string($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } return $_SESSION['csrf_token']; } function app_csrf_field(): string { return ''; } function app_verify_csrf(?string $token): bool { app_start_session(); if (!isset($_SESSION) || !is_array($_SESSION)) { $_SESSION = []; } return is_string($token) && isset($_SESSION['csrf_token']) && is_string($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token); } function app_require_csrf(): void { if ($_SERVER['REQUEST_METHOD'] !== 'POST') { return; } if (!app_verify_csrf($_POST['csrf_token'] ?? null)) { http_response_code(419); die('CSRF validation failed.'); } }