66cc8c8ade
Commit technique : reproduit à l'identique l'état non commité de la copie de travail (sécurisation V7.8, CSP à nonce, Session, migration des droits) afin que le travail d'ergonomie qui suit soit isolable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
30 lines
695 B
PHP
30 lines
695 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Core;
|
|
|
|
final class Csrf
|
|
{
|
|
public static function ensureToken(): string
|
|
{
|
|
Session::start();
|
|
|
|
if (empty($_SESSION['csrf_token'])) {
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
}
|
|
|
|
return (string) $_SESSION['csrf_token'];
|
|
}
|
|
|
|
public static function assertPayload(array $payload): void
|
|
{
|
|
$expected = self::ensureToken();
|
|
$provided = (string) ($payload['csrf_token'] ?? '');
|
|
|
|
if ($provided === '' || !hash_equals($expected, $provided)) {
|
|
JsonResponse::send(403, ['error' => 'Jeton de sécurité invalide. Rechargez la page.']);
|
|
}
|
|
}
|
|
}
|