Added CSRF protection

public/index.php

@@ -8,16 +8,24 @@ use Dotenv\Dotenv;
 use Slim\Factory\AppFactory;
 use Slim\Views\TwigMiddleware;
 use Slim\Views\Twig;
+use Slim\Csrf\Guard;
 use Medoo\Medoo;
 use App\Controllers\PostController;
 use App\Repositories\PostRepository;
 use App\Services\HtmlSanitizer;
 use App\Services\HtmlPurifierFactory;
+use App\Services\CsrfExtension;
 use App\Database\Migrator;
 use App\Bootstrap;
 use App\Routes;
 use App\Config;
 
+// ============================================
+// Démarrer la session PHP
+// ============================================
+
+session_start();
+
 // ============================================
 // Vérifier les répertoires
 // ============================================
@@ -38,16 +46,29 @@ $dotenv->load();
 $env = $_ENV['APP_ENV'] ?? 'production';
 $isDev = strtolower($env) === 'development';
 
+// ============================================
+// Initialisation de l'application Slim
+// ============================================
+
+$app = AppFactory::create();
+$responseFactory = $app->getResponseFactory();
+
 // ============================================
 // Initialisation des services
 // ============================================
 
+// CSRF Guard (middleware)
+$csrf = new Guard($responseFactory);
+
 // Twig
 $twig = Twig::create(
     __DIR__ . '/../views',
     ['cache' => Config::getTwigCache($isDev)]
 );
 
+// Ajouter l'extension CSRF à Twig
+$twig->addExtension(new CsrfExtension($csrf));
+
 // Medoo (SQLite)
 $dbFile = Config::getDatabasePath();
 $db = new Medoo([
@@ -69,13 +90,15 @@ $htmlSanitizer = new HtmlSanitizer($htmlPurifier);
 $postRepository = new PostRepository($db);
 
 // ============================================
-// Slim App
+// Middleware
 // ============================================
 
-$app = AppFactory::create();
 $app->addBodyParsingMiddleware();
 $app->add(TwigMiddleware::create($app, $twig));
 
+// Enregistrer le middleware CSRF pour toutes les routes
+$app->add($csrf);
+
 // ============================================
 // Routes
 // ============================================