Add CSRF protections to state-changing endpoints

2025-03-18 11:46:23 -04:00
parent f709c23bcc
commit d23cefa8a9
23 changed files with 239 additions and 79 deletions
--- a/token.php
+++ b/token.php
@@ -0,0 +1,5 @@
+<?php
+require 'config.php'; // Must call session_start() and generate CSRF token if not set
+header('Content-Type: application/json');
+echo json_encode(["csrf_token" => $_SESSION['csrf_token']]);
+?>