<?php
// 初始化Session
session_start();
 
/**
 * 生成并存儲(chǔ)Token
 */
function generateSessionToken() {
    $token = bin2hex(random_bytes(16));
    $_SESSION['csrf_token'] = $token;
    $_SESSION['csrf_token_expire'] = time() + 3600; // 1小時(shí)有效期
    return $token;
}
 
/**
 * 驗(yàn)證Session Token
 */
function verifySessionToken($token) {
    if (!isset($_SESSION['csrf_token']) || !isset($_SESSION['csrf_token_expire'])) {
        return false;
    }
    if (time() > $_SESSION['csrf_token_expire']) {
        unset($_SESSION['csrf_token'], $_SESSION['csrf_token_expire']);
        return false;
    }
    $isValid = hash_equals($_SESSION['csrf_token'], $token);
    if ($isValid) {
        unset($_SESSION['csrf_token'], $_SESSION['csrf_token_expire']);
    }
    return $isValid;
}
 
// 示例
$token = generateSessionToken();
echo '<input type="hidden" name="csrf_token" value="'.$token.'">';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $clientToken = $_POST['csrf_token'] ?? '';
    if (verifySessionToken($clientToken)) {
        echo 'Token驗(yàn)證通過，執(zhí)行業(yè)務(wù)邏輯';
    } else {
        echo 'Token無效或已過期';
    }
}
?>

<?php
require 'vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$secretKey = 'your_strong_secret_key';
$algorithm = 'HS256';

/**
 * 生成JWT Token
 */
function generateJwtToken($payload = []) {
    global $secretKey, $algorithm;
    $defaultPayload = [
        'iat' => time(),
        'exp' => time() + 3600,
    ];
    $payload = array_merge($defaultPayload, $payload);
    return JWT::encode($payload, $secretKey, $algorithm);
}

/**
 * 驗(yàn)證JWT Token
 */
function verifyJwtToken($token) {
    global $secretKey, $algorithm;
    try {
        $decoded = JWT::decode($token, new Key($secretKey, $algorithm));
        return (array)$decoded;
    } catch (Exception $e) {
        echo 'Token驗(yàn)證失敗：' . $e->getMessage();
        return false;
    }
}

// 示例
$userPayload = ['uid' => 1001, 'username' => 'test_user'];
$jwtToken = generateJwtToken($userPayload);
echo '生成的JWT Token：' . $jwtToken . '
';

$clientToken = $_GET['token'] ?? '';
$decodedData = verifyJwtToken($clientToken);
if ($decodedData) {
    echo 'Token驗(yàn)證通過，用戶ID：' . $decodedData['uid'];
} else {
    echo 'Token無效';
}
?>

<?php
function initRedis() {
    $redis = new Redis();
    try {
        $redis->connect('127.0.0.1', 6379);
        // $redis->auth('your_redis_password');
        return $redis;
    } catch (Exception $e) {
        echo 'Redis連接失敗：' . $e->getMessage();
        return null;
    }
}

function generateRedisToken($uid, $expire = 3600) {
    $redis = initRedis();
    if (!$redis) return false;
    $token = md5($uid . time() . random_bytes(16));
    $tokenKey = 'token:' . $token;
    $redis->setex($tokenKey, $expire, $uid);
    return $token;
}

function verifyRedisToken($token) {
    $redis = initRedis();
    if (!$redis) return false;
    $tokenKey = 'token:' . $token;
    $uid = $redis->get($tokenKey);
    if ($uid) {
        $redis->expire($tokenKey, 3600); // 滑動(dòng)有效期
        return (int)$uid;
    }
    return false;
}

function destroyRedisToken($token) {
    $redis = initRedis();
    if (!$redis) return false;
    $tokenKey = 'token:' . $token;
    return $redis->del($tokenKey) > 0;
}

// 示例
$token = generateRedisToken(1001);
echo 'Redis Token：' . $token . '<br>';

$clientToken = $_POST['token'] ?? '';
$uid = verifyRedisToken($clientToken);
if ($uid) {
    echo 'Token驗(yàn)證通過，用戶ID：' . $uid;
} else {
    echo 'Token無效或已過期';
}

// destroyRedisToken($clientToken);
?>

CREATE TABLE `user_token` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `uid` int(11) NOT NULL COMMENT '用戶ID',
  `token` varchar(64) NOT NULL COMMENT '令牌值',
  `create_time` int(11) NOT NULL COMMENT '創(chuàng)建時(shí)間（時(shí)間戳）',
  `expire_time` int(11) NOT NULL COMMENT '過期時(shí)間（時(shí)間戳）',
  `status` tinyint(1) NOT NULL DEFAULT 1 COMMENT '1-有效 0-無效',
  PRIMARY KEY (`id`),
  UNIQUE KEY `idx_token` (`token`),
  KEY `idx_uid` (`uid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用戶令牌表';

<?php
$dbConfig = [
    'host' => '127.0.0.1',
    'user' => 'root',
    'password' => 'your_db_password',
    'dbname' => 'test',
    'charset' => 'utf8mb4'
];

function initDb() {
    global $dbConfig;
    try {
        $dsn = "mysql:host={$dbConfig['host']};dbname={$dbConfig['dbname']};charset={$dbConfig['charset']}";
        $pdo = new PDO($dsn, $dbConfig['user'], $dbConfig['password']);
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        return $pdo;
    } catch (PDOException $e) {
        echo '數(shù)據(jù)庫連接失?。? . $e->getMessage();
        return null;
    }
}

function generateDbToken($uid, $expire = 3600) {
    $pdo = initDb();
    if (!$pdo) return false;
    $token = hash('sha256', $uid . time() . random_bytes(32));
    $createTime = time();
    $expireTime = $createTime + $expire;
    $sql = "INSERT INTO user_token (uid, token, create_time, expire_time, status) VALUES (:uid, :token, :create_time, :expire_time, 1)";
    $stmt = $pdo->prepare($sql);
    $stmt->bindParam(':uid', $uid, PDO::PARAM_INT);
    $stmt->bindParam(':token', $token, PDO::PARAM_STR);
    $stmt->bindParam(':create_time', $createTime, PDO::PARAM_INT);
    $stmt->bindParam(':expire_time', $expireTime, PDO::PARAM_INT);
    return $stmt->execute() ? $token : false;
}

function verifyDbToken($token) {
    $pdo = initDb();
    if (!$pdo) return false;
    $now = time();
    $sql = "SELECT uid FROM user_token WHERE token = :token AND status = 1 AND expire_time > :now LIMIT 1";
    $stmt = $pdo->prepare($sql);
    $stmt->bindParam(':token', $token, PDO::PARAM_STR);
    $stmt->bindParam(':now', $now, PDO::PARAM_INT);
    $stmt->execute();
    $result = $stmt->fetch(PDO::FETCH_ASSOC);
    if ($result) {
        return (int)$result['uid'];
    }
    return false;
}

function destroyDbToken($token) {
    $pdo = initDb();
    if (!$pdo) return false;
    $sql = "UPDATE user_token SET status = 0 WHERE token = :token";
    $stmt = $pdo->prepare($sql);
    $stmt->bindParam(':token', $token, PDO::PARAM_STR);
    return $stmt->execute() && $stmt->rowCount() > 0;
}

// 示例
$token = generateDbToken(1001);
echo '數(shù)據(jù)庫Token：' . $token . '<br>';

$clientToken = $_SERVER['HTTP_TOKEN'] ?? '';
$uid = verifyDbToken($clientToken);
if ($uid) {
    echo 'Token驗(yàn)證通過，用戶ID：' . $uid;
} else {
    echo 'Token無效或已過期';
}

// destroyDbToken($clientToken);
?>