25 lines
579 B
PHP
25 lines
579 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace BattleForge\Http;
|
|
|
|
final class CsrfToken
|
|
{
|
|
/** @return array{0: string, 1: string} */
|
|
public static function issue(string $secret): array
|
|
{
|
|
$token = bin2hex(random_bytes(32));
|
|
$cookie = hash_hmac('sha256', $token, $secret);
|
|
|
|
return [$token, $cookie];
|
|
}
|
|
|
|
public static function verify(string $submitted, string $secret, string $expectedCookieValue): bool
|
|
{
|
|
$computed = hash_hmac('sha256', $submitted, $secret);
|
|
|
|
return hash_equals($expectedCookieValue, $computed);
|
|
}
|
|
}
|