feat(security): implement session management features including idle timeout, keepalive, and secure logout

2026-09-11 15:47:09 +02:00
parent dc740fb94d
commit e012d6d21c
7 changed files with 515 additions and 5 deletions
@@ -0,0 +1,72 @@
+<?php
+/**
+ * Fociz Session Guard API (Release v1.6)
+ * Ondersteunt realtime session keepalive, inactiviteitstimeout status en veilige logout
+ * Conform NIST SP 800-63B, OWASP ASVS v4.0 en ISO 27001
+ */
+
+require_once __DIR__ . '/../includes/auth.php';
+require_once __DIR__ . '/../includes/settings.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+$currentUser = require_auth(true);
+$userId = (int)($currentUser['id'] ?? 0);
+
+$action = $_GET['action'] ?? ($_POST['action'] ?? 'keepalive');
+$idleTimeout = get_session_idle_timeout();
+$now = time();
+
+if ($action === 'keepalive' || $action === 'ping') {
+    // Verleng de activiteitstimer van de sessie
+    $_SESSION['last_activity'] = $now;
+
+    echo json_encode([
+        'success'   => true,
+        'remaining' => $idleTimeout,
+        'timeout'   => $idleTimeout,
+        'timestamp' => $now
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
+if ($action === 'status') {
+    $lastActivity = (int)($_SESSION['last_activity'] ?? $now);
+    $elapsed = $now - $lastActivity;
+    $remaining = max(0, $idleTimeout - $elapsed);
+
+    echo json_encode([
+        'success'   => true,
+        'remaining' => $remaining,
+        'timeout'   => $idleTimeout,
+        'timestamp' => $now
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
+if ($action === 'logout') {
+    try {
+        $db = get_db_connection();
+        $stmt = $db->prepare("UPDATE users SET remember_token = NULL, remember_token_expires_at = NULL WHERE id = ?");
+        $stmt->execute([$userId]);
+
+        fociz_log_audit($userId, 'LOGOUT_SESSION_GUARD', 'users', $userId, ['ip' => fociz_get_client_ip()], 'SUCCESS', $currentUser['email'] ?? null);
+    } catch (Throwable $e) {
+        error_log("Session guard logout error: " . $e->getMessage());
+    }
+
+    clear_day_session_cookie();
+    $_SESSION = [];
+    if (session_status() === PHP_SESSION_ACTIVE) {
+        @session_regenerate_id(true);
+        @session_destroy();
+    }
+
+    echo json_encode(['success' => true, 'message' => 'Succesvol uitgelogd.'], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
+http_response_code(400);
+echo json_encode(['success' => false, 'error' => 'Onbekende sessieactie.'], JSON_UNESCAPED_UNICODE);
+exit;
+