0, 'path' => '/', 'secure' => $isHttps, 'httponly' => true, 'samesite' => 'Strict', ]); session_start(); } function csrf_token(): string { if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } return $_SESSION['csrf_token']; } function csrf_field(): string { return ''; } function csrf_verify(?string $token): bool { return is_string($token) && $token !== '' && isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token); }