public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        // Get a valid signature.
        $signature = ($this->signature)($request);

        if (! is_array($signature)) {

            throw new OwnershipSignatureTypeException($signature);

        }

        // Invalidate the session when signature and session does not match.
        $metadata = $_SESSION[self::METADATA_KEY] ?? [];

        if (! $this->compare($signature, $metadata)) {

            $_SESSION = [];
            session_regenerate_id();

        }

        // Process the request and save the current signature.
        $response = $handler->handle($request);

        $_SESSION[self::METADATA_KEY] = $signature;

        return $response;
    }