src/includes/classes/Core/Utils/Nonce.php
public function verify(string $action = null, string $token = null, callable $callback = null): bool
    {
        if (!isset($token)) {
            $token = (string) $_REQUEST['_nonce'];
        } // Defaults to current request.

        $action = mb_strtolower($action ?? '');
        $token  = mb_strtolower($token);

        if (isset($callback)) {
            return $callback($action, $token);
        }
        if ($this->c::isActiveSession()) {
            if (!isset($_SESSION['_nonce'][$token])) {
                return false; // Bad token.
            } // Reference Nonce in session.
            $Nonce = &$_SESSION['_nonce'][$token];

            if ($action !== $Nonce->action) {
                return false;
            } elseif (time() >= $Nonce->expire_time) {
                return false;
            } elseif ($Nonce->used) {
                return false;
            }
            return $Nonce->used = true;
        }
        throw $this->c::issue('No verification handler.');
    }
public function verify(string $action = null, string $token = null, callable $callback = null): bool
    {
        if (!isset($token)) {
            $token = (string) $_REQUEST['_nonce'];
        } // Defaults to current request.

        $action = mb_strtolower($action ?? '');
        $token  = mb_strtolower($token);

        if (isset($callback)) {
            return $callback($action, $token);
        }
        if ($this->c::isActiveSession()) {
            if (!isset($_SESSION['_nonce'][$token])) {
                return false; // Bad token.
            } // Reference Nonce in session.
            $Nonce = &$_SESSION['_nonce'][$token];

            if ($action !== $Nonce->action) {
                return false;
            } elseif (time() >= $Nonce->expire_time) {
                return false;
            } elseif ($Nonce->used) {
                return false;
            }
            return $Nonce->used = true;
        }
        throw $this->c::issue('No verification handler.');
    }
Nonce verifier.

@since 17xxxx Nonce utils.

@param string|null   $action   Action.
@param string|null   $token    Token.
@param callable|null $callback Callback.

@return bool True if token is verified.

@note Callback verifies token and flags token as having been used once before.
Or, if there is no callback, a built-in `$_SESSION` storage handler is used by default.