Switch to session ids

3 files changed, 60 insertions, 8 deletions

diff --git a/php/session.php b/php/session.php
new file mode 100755
index 0000000..7895dfb
--- /dev/null
+++ b/php/session.php
@@ -0,0 +1,50 @@
+<?php
+/*
+ *  GNUfault.org - GNUfault's website
+ *  Copyright (C) 2026  Connor Thomson
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+function start_session(): void {
+    if (session_status() === PHP_SESSION_ACTIVE) {
+        return;
+    }
+
+    session_set_cookie_params([
+        'lifetime' => 0,
+        'path'     => '/',
+        'secure'   => true,
+        'httponly' => true,
+        'samesite' => 'Strict'
+    ]);
+
+    session_start();
+}
+
+function set_user_id(int $user_id): void {
+    start_session();
+
+    session_regenerate_id(true);
+
+    $_SESSION['user_id'] = $user_id;
+}
+
+function get_user_id(): ?int {
+    start_session();
+
+    return isset($_SESSION['user_id']) ? (int)$_SESSION['user_id'] : null;
+}
+
+?>
diff --git a/signup/signup.php b/signup/signup.php
index 5ba3ca8..4300b61 100755
--- a/signup/signup.php
+++ b/signup/signup.php
@@ -17,6 +17,10 @@
  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
+define('ROOT', rtrim($_SERVER['DOCUMENT_ROOT'], '/') . '/');
+
+require_once ROOT . '/php/session.php';
+
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
     $username        = $_POST['username'];
     $password        = $_POST['password'];
@@ -64,13 +68,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
 
         $user_id = $pdo->lastInsertId();
 
-        setcookie('user_id', (string)$user_id, [
-            'expires'  => 2147483647,
-            'path'     => '/',
-            'secure'   => true,
-            'httponly' => true,
-            'samesite' => 'Strict'
-        ]);
+        set_user_id((int)$user_id);
     } catch (\PDOException $e) {
         if ($e->getCode() == 23000) {
             echo "Error: Username or email is already taken.";
diff --git a/signup/verify/verify.php b/signup/verify/verify.php
index e5e729f..1fc6202 100755
--- a/signup/verify/verify.php
+++ b/signup/verify/verify.php
@@ -17,9 +17,13 @@
  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
+define('ROOT', rtrim($_SERVER['DOCUMENT_ROOT'], '/') . '/');
+
+require_once ROOT . '/php/session.php';
+
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
     $code    = $_POST['code'];
-    $user_id = $_COOKIE['user_id'] ?? null;
+    $user_id = get_user_id();
 
     if (!$user_id) {
         echo "Not logged in.";