<?php

namespace WPD\Security;

final class Csrf
{
    public static function token()
    {
        if (empty($_SESSION['wpd_csrf'])) {
            $_SESSION['wpd_csrf'] = bin2hex(random_bytes(24));
        }

        return $_SESSION['wpd_csrf'];
    }

    public static function validate($token)
    {
        return is_string($token)
            && isset($_SESSION['wpd_csrf'])
            && hash_equals($_SESSION['wpd_csrf'], $token);
    }
}

