From 46d7ca369458af73b94d62c2e2c485ca9c06f3ea Mon Sep 17 00:00:00 2001
From: Zaki <18zaki18@gmail.com>
Date: Sat, 9 May 2026 22:24:08 +0100
Subject: [PATCH] Add CSP header and session rotation on login

Content-Security-Policy: default-src 'self'; restricts external resource loading. Session rotation: delete all existing sessions for a user on login, so re-logging invalidates any leaked tokens.
---
 api.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/api.php b/api.php
index bde09b3..d2f9753 100644
--- a/api.php
+++ b/api.php
@@ -14,6 +14,7 @@ set_exception_handler(function($e) use ($logFile) {
 
 header('Content-Type: application/json');
 header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
+header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'");
 
 $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
 if ($origin && preg_match('#^https?://(localhost|127\.0\.0\.1)(:\d+)?$#', $origin)) {
@@ -297,6 +298,9 @@ try {
                 $upd->execute();
             }
             clearAttempts($db);
+            $delSessions = $db->prepare('DELETE FROM sessions WHERE user_id=:uid');
+            $delSessions->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
+            $delSessions->execute();
             $defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
             $stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
             foreach ($defaultFolders as $name) {