Glacier/app/middleware/CsrfMiddleware.php

<?php

declare(strict_types=1);

namespace Glacier\Middleware;

use Glacier\Core\Logger;
use Glacier\Core\Response;
use Glacier\Core\Session;

/**
 * CSRF 中间件：写方法（POST/PUT/PATCH/DELETE）校验 Token。
 * Token 来源：表单字段 csrf_token 或请求头 X-CSRF-Token。
 */
final class CsrfMiddleware
{
    public function handle(array $params = []): void
    {
        $method = strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET');
        if (!in_array($method, ['POST', 'PUT', 'PATCH', 'DELETE'], true)) {
            return; // 读方法放行
        }
        $token = $_POST['csrf_token'] ?? ($_SERVER['HTTP_X_CSRF_TOKEN'] ?? '');
        if (!Session::csrfCheck((string) $token)) {
            Logger::warning('csrf check failed', ['method' => $method, 'path' => $_SERVER['REQUEST_URI'] ?? '/']);
            Response::text('CSRF 校验失败', 403);
        }
    }
}