<?php
/**
 * DWSK CSRF Token Endpoint
 * ---------------------------------------------------------------
 * The frontend calls this once on page load to obtain a token tied
 * to the visitor's session. That token is then submitted with the
 * Order/Careers/Contact forms and verified server-side, to guard
 * against cross-site request forgery.
 */

define('DWSK_APP', true);

session_start();

if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store, no-cache, must-revalidate');
echo json_encode(['token' => $_SESSION['csrf_token']]);
