* Uso in fetch: header 'X-CSRF-TOKEN': '' * Uso nei salvataggi: yb_csrf_check(); (blocca con 403) * if (!yb_csrf_valid()) (per gli endpoint JSON) */ function yb_csrf_token(): string { if (session_status() !== PHP_SESSION_ACTIVE) { session_start(); } if (empty($_SESSION['_csrf'])) { $_SESSION['_csrf'] = bin2hex(random_bytes(32)); } return $_SESSION['_csrf']; } function yb_csrf_field(): string { return ''; } function yb_csrf_valid(): bool { $sent = $_POST['_csrf'] ?? ($_SERVER['HTTP_X_CSRF_TOKEN'] ?? ''); return is_string($sent) && $sent !== '' && hash_equals(yb_csrf_token(), $sent); } function yb_csrf_check(): void { if (!yb_csrf_valid()) { http_response_code(403); exit('Sessione scaduta: ricarica la pagina e riprova.'); } }