session.php

<?php
// session is only used to hold the CSRF token
require_once(__DIR__."/webauth/webauth.php");
require_once(__DIR__."/queries/db-connect.php");
require_once(__DIR__."/queries/response.php");

// whether the HTTPS checks believe X-Forwarded-Proto: it is set by the client
// unless a proxy overwrites it, so it is only believed if $trust_forwarded_proto
// is set in config.php (only do that if the web server can only be reached through
// the proxy which terminates TLS)
function todoTrustsForwardedProto() {
    return todoConfig('trust_forwarded_proto') === true;
}

function todoStartSession($readOnly) {
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }
    session_name("todo_session");
    // a request without session cookie cannot carry a valid token: don't create a session for it
    if ($readOnly && !isset($_COOKIE[session_name()])) {
        return;
    }
    // never accept a session ID which the server did not create
    ini_set('session.use_strict_mode', '1');
    // keep the Cache-Control header of todo-core.php, PHP would replace it when the session starts
    session_cache_limiter('');
    session_set_cookie_params(WebAuth\Session::cookieParams($_SERVER, 0, 'Strict', todoTrustsForwardedProto()));
    session_start($readOnly ? array('read_and_close' => true) : array());
}

// token for the page, created on first use
function csrfToken() {
    todoStartSession(false);
    if (empty($_SESSION['csrf'])) {
        $_SESSION['csrf'] = WebAuth\Csrf::newToken();
    }
    $token = $_SESSION['csrf'];
    session_write_close();
    return $token;
}

// for requests that modify data: must be POST and carry the page's token; refused with a
// JSON error (405 or 403) like the endpoints do it
function requirePostWithCsrf() {
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        header('Allow: POST');
        require_once(__DIR__."/lang.php");
        exitWithError(405, TodoLang::_("METHOD_NOT_ALLOWED"));
    }
    todoStartSession(true);
    $token = isset($_SERVER['HTTP_X_CSRF_TOKEN']) ? $_SERVER['HTTP_X_CSRF_TOKEN'] : '';
    if (!WebAuth\Csrf::isValid(isset($_SESSION['csrf']) ? $_SESSION['csrf'] : null, $token)) {
        require_once(__DIR__."/lang.php");
        exitWithError(403, TodoLang::_("INVALID_CSRF_TOKEN"));
    }
}