Session guard refresh 1s

includes/auth.php

@@ -28,9 +28,6 @@ function is_https_request(): bool {
     if (isset($_SERVER['SERVER_PORT']) && (int)$_SERVER['SERVER_PORT'] === 443) {
         return true;
     }
-    if (defined('APP_URL') && str_starts_with(APP_URL, 'https://')) {
-        return true;
-    }
     return false;
 }
 
@@ -306,9 +303,8 @@ function start_secure_session(): void {
         ini_set('session.gc_maxlifetime', '86400');
         ini_set('session.cookie_httponly', '1');
 
-        // Cookie prefix: __Host- garandeert dat cookies niet door subdomeinen kunnen worden overschreven
-        $sessionName = $isSecure ? '__Host-fociz_session' : 'fociz_session';
-        session_name($sessionName);
+        // Sessienaam instellen (veilig en uniform)
+        session_name('fociz_session');
 
         session_set_cookie_params([
             'lifetime' => 0, // Browser sessiecookie: vervalt direct bij afsluiten browser conform ISO 27001 / NIST SP 800-63B
@@ -501,7 +497,12 @@ function fociz_is_session_active(string $sessionId, int $userId): bool {
         $stmt = $db->prepare("SELECT is_active, expires_at FROM user_sessions WHERE session_id_hash = ? AND user_id = ?");
         $stmt->execute([$hash, $userId]);
         $row = $stmt->fetch();
-        if (!$row) return true; // Als sessie nog niet geregistreerd staat, laat het door (wordt geregistreerd)
+        if (!$row) {
+            // Als sessie nog niet geregistreerd staat, registreer direct om tracking consistent te houden
+            $maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
+            fociz_register_active_session($userId, $sessionId, $maxIdleSeconds);
+            return true;
+        }
         return (!empty($row['is_active']));
     } catch (Throwable $e) {
         return true; // Fallback op toegestaan bij databaseverstoring

includes/header.php

@@ -64,9 +64,12 @@ $currentUserTheme = !empty($currentUser['id']) ? get_user_theme((int)$currentUse
     <script>
         (function() {
             try {
+                let hasRedirected = false;
                 const sessionExpiresAt = <?= strtotime('today 23:59:59') ?> * 1000;
                 const checkExpiry = function() {
+                    if (hasRedirected) return;
                     if (Date.now() > sessionExpiresAt + 1000) {
+                        hasRedirected = true;
                         window.location.href = '/auth/login.php?expired=1';
                     }
                 };