1 files changed, 15 insertions, 0 deletions
diff --git a/partials/session.php b/partials/session.php
new file mode 100644
index 0000000..d4ee141
--- /dev/null
+++ b/partials/session.php
@@ -0,0 +1,15 @@
+<?php
+// Shared session bootstrap. Must be included before any output.
+// Security headers (CSP, HSTS, nosniff, Referrer-Policy, Permissions-Policy)
+// are owned by nginx — do not re-emit them here (browsers can conflict on
+// duplicate policies).
+if (session_status() !== PHP_SESSION_ACTIVE) {
+    session_set_cookie_params([
+        'lifetime' => 0,
+        'path' => '/',
+        'secure' => true,
+        'httponly' => true,
+        'samesite' => 'Lax',
+    ]);
+    session_start();
+}