0,
'path' => '/',
'domain' => '',
'secure' => $https,
'httponly' => true,
'samesite' => 'Lax',
]);
if (session_status() !== PHP_SESSION_ACTIVE) {
session_start();
}
if (empty($_SESSION['simon_csrf'])) {
$_SESSION['simon_csrf'] = bin2hex(random_bytes(32));
}
$transactionId = strtoupper(substr(bin2hex(random_bytes(8)), 0, 8));
$nonce = base64_encode(random_bytes(18));
function simon_escape(string $value): string
{
return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'logout') {
$postedToken = (string) ($_POST['csrf_token'] ?? '');
$sessionToken = (string) ($_SESSION['simon_csrf'] ?? '');
if ($sessionToken === '' || !hash_equals($sessionToken, $postedToken)) {
http_response_code(403);
exit('XO SECURITY: Invalid logout request.');
}
$_SESSION = [];
if (ini_get('session.use_cookies')) {
$params = session_get_cookie_params();
setcookie(
session_name(),
'',
time() - 42000,
$params['path'],
$params['domain'],
(bool) $params['secure'],
(bool) $params['httponly']
);
}
session_destroy();
header('Location: /auth/login.php?logged_out=1', true, 303);
exit;
}
$userLabel = 'GUEST';
foreach (['email', 'user_email', 'name', 'user_name'] as $key) {
if (!empty($_SESSION[$key]) && is_string($_SESSION[$key])) {
$userLabel = $_SESSION[$key];
break;
}
}
header('Content-Type: text/html; charset=UTF-8');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()');
header('Cross-Origin-Opener-Policy: same-origin');
header('Cross-Origin-Resource-Policy: same-origin');
header("Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; img-src 'self' data: blob:; style-src 'self' 'nonce-{$nonce}'; script-src 'self' 'nonce-{$nonce}'; connect-src 'self'");
?>
SIMON — GAY STAR Royal Sunflower Seed — Green Gold
GAY STAR // ROYAL STAR // SUNFLOWER SEED
XO SECURITY
● PROTECTED
TRANS ID:
USER:
MOVE — TILT | CLICK — STAR BURST |
SCROLL — ZOOM | RIGHT CLICK — COLOUR SHIFT |
HOLD — GRAVITY PULL