<?php
// session_config_emp.php - Include this at the top of ALL your emp*.php files

// Enhanced session configuration
ini_set('session.cookie_httponly', 1);
ini_set('session.use_strict_mode', 1);
ini_set('session.cookie_lifetime', 0);
ini_set('session.gc_maxlifetime', 1800); // 30 minutes
ini_set('session.cookie_samesite', 'Lax'); // Add SameSite attribute

// Only start session if not already started
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

// Debug: Log session status
error_log("Session config loaded - ID: " . session_id() . " - Status: " . session_status());

// Initialize CSRF token if it doesn't exist
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    error_log("New CSRF token generated: " . $_SESSION['csrf_token']);
}

// Simplified token regeneration - remove the counter logic as it may cause issues
// Just ensure token exists, don't regenerate automatically
?>