src/ValidateSessionMiddleware.php
public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        // Get a valid signature.
        $signature = ($this->signature)($request);

        if (! is_array($signature)) {

            throw new OwnershipSignatureTypeException($signature);

        }

        // Invalidate the session when signature and session does not match.
        $metadata = $_SESSION[self::METADATA_KEY] ?? [];

        if (! $this->compare($signature, $metadata)) {

            $_SESSION = [];
            session_regenerate_id();

        }

        // Process the request and save the current signature.
        $response = $handler->handle($request);

        $_SESSION[self::METADATA_KEY] = $signature;

        return $response;
    }
public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        // Get a valid signature.
        $signature = ($this->signature)($request);

        if (! is_array($signature)) {

            throw new OwnershipSignatureTypeException($signature);

        }

        // Invalidate the session when signature and session does not match.
        $metadata = $_SESSION[self::METADATA_KEY] ?? [];

        if (! $this->compare($signature, $metadata)) {

            $_SESSION = [];
            session_regenerate_id();

        }

        // Process the request and save the current signature.
        $response = $handler->handle($request);

        $_SESSION[self::METADATA_KEY] = $signature;

        return $response;
    }
public function process ( ServerRequestInterface $ request , RequestHandlerInterface $ handler ) : ResponseInterface { // Get a valid signature. $ signature = ( $ this -> signature ) ( $ request ) ; if ( ! is_array ( $ signature ) ) { throw new OwnershipSignatureTypeException ( $ signature ) ; } // Invalidate the session when signature and session does not match. $ metadata = $ _SESSION [ self :: METADATA_KEY ] ?? [ ] ; if ( ! $ this -> compare ( $ signature , $ metadata ) ) { $ _SESSION = [ ] ; session_regenerate_id ( ) ; } // Process the request and save the current signature. $ response = $ handler -> handle ( $ request ) ; $ _SESSION [ self :: METADATA_KEY ] = $ signature ; return $ response ; }
Build a signature and compare it to the ownership metadata stored in
session. Invalidate the session when any key does not match. Process the
request and save the current signature in session.

@param \Psr\Http\Message\ServerRequestInterface  $request
@param \Psr\Http\Server\RequestHandlerInterface  $handler
@return \Psr\Http\Message\ResponseInterface
Build a signature and compare it to the ownership metadata stored in session . Invalidate the session when any key does not match . Process the request and save the current signature in session .