public function verify(string $_csrf = null, callable $callback = null): bool
    {
        if (!isset($_csrf)) {
            $_csrf = (string) $_REQUEST['_csrf'];
        } // Defaults to current request.

        if ($this->c::isActiveSession()) {
            if (empty($_SESSION['_csrf'])) {
                return false; // No token.
            }
            return $this->c::hashEquals($_SESSION['_csrf'], $_csrf);
        }
        throw $this->c::issue('No verification handler.');
    }
public function verify(string $_csrf = null, callable $callback = null): bool
    {
        if (!isset($_csrf)) {
            $_csrf = (string) $_REQUEST['_csrf'];
        } // Defaults to current request.

        if ($this->c::isActiveSession()) {
            if (empty($_SESSION['_csrf'])) {
                return false; // No token.
            }
            return $this->c::hashEquals($_SESSION['_csrf'], $_csrf);
        }
        throw $this->c::issue('No verification handler.');
    }
public function verify ( string $ _csrf = null , callable $ callback = null ) : bool { if ( ! isset ( $ _csrf ) ) { $ _csrf = ( string ) $ _REQUEST [ '_csrf' ] ; } // Defaults to current request. if ( $ this -> c :: isActiveSession ( ) ) { if ( empty ( $ _SESSION [ '_csrf' ] ) ) { return false ; // No token. } return $ this -> c :: hashEquals ( $ _SESSION [ '_csrf' ] , $ _csrf ) ; } throw $ this -> c :: issue ( 'No verification handler.' ) ; }
CSRF verifier.

@since 17xxxx CSRF utils.

@param string|null   $_csrf    Token.
@param callable|null $callback Callback.

@return bool True if token is verified.

@note Callback verifies the CSRF token.
If no callback, `$_SESSION` is used by default.
CSRF verifier .