30 lines
633 B
PHP
30 lines
633 B
PHP
<?php
|
|
|
|
namespace App\Core;
|
|
|
|
final class Csrf
|
|
{
|
|
public function __construct(private readonly Session $session)
|
|
{
|
|
}
|
|
|
|
public function token(): string
|
|
{
|
|
$token = $this->session->get('_csrf_token');
|
|
|
|
if (!is_string($token) || $token === '') {
|
|
$token = bin2hex(random_bytes(32));
|
|
$this->session->put('_csrf_token', $token);
|
|
}
|
|
|
|
return $token;
|
|
}
|
|
|
|
public function validate(?string $token): bool
|
|
{
|
|
$expected = $this->session->get('_csrf_token');
|
|
|
|
return is_string($expected) && is_string($token) && hash_equals($expected, $token);
|
|
}
|
|
}
|