<?php
require __DIR__ . '/session.php';

start_app_session();

if ($_SERVER['REQUEST_METHOD'] !== 'POST' || !csrf_verify($_POST['csrf_token'] ?? null)) {
    header('Location: /');
    exit;
}

$_SESSION = [];
session_destroy();

setcookie(session_name(), '', [
    'expires' => time() - 3600,
    'path' => '/',
    'httponly' => true,
    'samesite' => 'Strict',
]);

header('Location: /');
exit;