32 lines
901 B
PHP
32 lines
901 B
PHP
<?php
|
|
namespace App\Middleware;
|
|
|
|
use App\Helpers\Response;
|
|
use App\Helpers\Security;
|
|
|
|
/**
|
|
* Class CsrfMiddleware
|
|
* Cross-Site Request Forgery (CSRF) Protection Middleware
|
|
*
|
|
* @package App\Middleware
|
|
*/
|
|
class CsrfMiddleware
|
|
{
|
|
/**
|
|
* Verify CSRF token for state-changing requests (POST, PUT, DELETE)
|
|
*/
|
|
public static function handle(): void
|
|
{
|
|
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
|
|
|
|
if (in_array($method, ['POST', 'PUT', 'DELETE', 'PATCH'], true)) {
|
|
$headers = getallheaders();
|
|
$token = $headers['X-CSRF-Token'] ?? $headers['x-csrf-token'] ?? $_POST['_csrf_token'] ?? null;
|
|
|
|
if (!Security::verifyCsrfToken($token)) {
|
|
Response::error("CSRF Token Validation Failed: Request is forged or session expired (กรุณารีเฟรชหน้าเว็บ)", 403);
|
|
}
|
|
}
|
|
}
|
|
}
|