smacks
01a6d0f00a
- Move 374-line inline style block from login.php into assets/style.css (Phase 2 section) - Add auth-page, auth-card, auth-tabs, auth-form, profile-shell and related classes to the main stylesheet as the single source of truth for all styles - Fix Firebase v10 compat SDK error code: auth/invalid-credential now handled alongside legacy auth/wrong-password and auth/user-not-found codes - Harden api/session.php: add Content-Type JSON header, email format validation, and a full security documentation comment explaining the token trust model - Add FOUC comment to partials/head.php clarifying dark-only design intent
63 lines
2.2 KiB
PHP
63 lines
2.2 KiB
PHP
<?php
|
||
/**
|
||
* PHP Session Synchronizer for Firebase Auth
|
||
*
|
||
* This endpoint is called client-side via XHR whenever Firebase Auth detects
|
||
* a state change (login or logout). It creates or destroys a PHP session that
|
||
* mirrors the Firebase auth state, allowing server-rendered PHP pages to react
|
||
* to auth status.
|
||
*
|
||
* SECURITY NOTE: This endpoint accepts the Firebase UID and email from the
|
||
* client POST body and trusts them to set the PHP session. The Firebase ID Token
|
||
* is stored but NOT cryptographically verified server-side (which would require
|
||
* the Firebase Admin SDK or a REST call to the Google tokeninfo endpoint).
|
||
* This is an acceptable trade-off for a low-risk food blog, but for a
|
||
* production app handling sensitive data, server-side token verification
|
||
* via the Firebase Admin SDK should be implemented.
|
||
*/
|
||
|
||
header('Content-Type: application/json');
|
||
|
||
if (session_status() === PHP_SESSION_NONE) {
|
||
session_start();
|
||
}
|
||
|
||
$action = $_POST['action'] ?? '';
|
||
|
||
if ($action === 'login') {
|
||
$uid = trim($_POST['uid'] ?? '');
|
||
$email = trim($_POST['email'] ?? '');
|
||
$token = trim($_POST['token'] ?? '');
|
||
|
||
// Validate required fields – reject obviously malformed requests early
|
||
if ($uid === '' || $email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||
http_response_code(400);
|
||
echo json_encode(['status' => 'error', 'message' => 'Invalid or missing uid/email']);
|
||
exit;
|
||
}
|
||
|
||
$_SESSION['fc_user'] = [
|
||
'uid' => $uid,
|
||
'email' => $email,
|
||
'token' => $token, // Stored for potential future server-side verification
|
||
];
|
||
echo json_encode(['status' => 'success', 'message' => 'Logged in']);
|
||
|
||
} elseif ($action === 'logout') {
|
||
$_SESSION = [];
|
||
if (ini_get('session.use_cookies')) {
|
||
$params = session_get_cookie_params();
|
||
setcookie(
|
||
session_name(), '', time() - 42000,
|
||
$params['path'], $params['domain'],
|
||
$params['secure'], $params['httponly']
|
||
);
|
||
}
|
||
session_destroy();
|
||
echo json_encode(['status' => 'success', 'message' => 'Logged out']);
|
||
|
||
} else {
|
||
http_response_code(400);
|
||
echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
|
||
}
|