'; } /** * Verify the token from a form field or the X-CSRF-Token header (API calls). * Ends the request on failure. */ function csrf_verify(): void { session_boot(); $sent = $_POST['_csrf'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? ''; if (empty($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], (string)$sent)) { http_response_code(419); exit('Invalid or missing CSRF token. Go back, reload the page and try again.'); } }