flixcooks-website/api/session.php

<?php
/**
 * PHP Session Synchronizer for Firebase Auth
 *
 * This endpoint is called client-side via XHR whenever Firebase Auth detects
 * a state change (login or logout). It creates or destroys a PHP session that
 * mirrors the Firebase auth state, allowing server-rendered PHP pages to react
 * to auth status.
 *
 * SECURITY NOTE: This endpoint accepts the Firebase UID and email from the
 * client POST body and trusts them to set the PHP session. The Firebase ID Token
 * is stored but NOT cryptographically verified server-side (which would require
 * the Firebase Admin SDK or a REST call to the Google tokeninfo endpoint).
 * This is an acceptable trade-off for a low-risk food blog, but for a
 * production app handling sensitive data, server-side token verification
 * via the Firebase Admin SDK should be implemented.
 */

header('Content-Type: application/json');

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

$action = $_POST['action'] ?? '';

if ($action === 'login') {
    $uid   = trim($_POST['uid']   ?? '');
    $email = trim($_POST['email'] ?? '');
    $token = trim($_POST['token'] ?? '');

    // Validate required fields – reject obviously malformed requests early
    if ($uid === '' || $email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
        http_response_code(400);
        echo json_encode(['status' => 'error', 'message' => 'Invalid or missing uid/email']);
        exit;
    }

    $_SESSION['fc_user'] = [
        'uid'   => $uid,
        'email' => $email,
        'token' => $token, // Stored for potential future server-side verification
    ];
    echo json_encode(['status' => 'success', 'message' => 'Logged in']);

} elseif ($action === 'logout') {
    $_SESSION = [];
    if (ini_get('session.use_cookies')) {
        $params = session_get_cookie_params();
        setcookie(
            session_name(), '', time() - 42000,
            $params['path'], $params['domain'],
            $params['secure'], $params['httponly']
        );
    }
    session_destroy();
    echo json_encode(['status' => 'success', 'message' => 'Logged out']);

} else {
    http_response_code(400);
    echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
}