@extends('errors._layout')

@section('title', 'Session expired')
@section('code', '419')
@section('codeLabel', 'Error code 419')
@section('headline', 'Your session expired')

@section('body')
    <p>For security, sessions time out after a period of inactivity. Go back and try again — your form will pick up a fresh CSRF token.</p>
@endsection

@php
    /*
     * Safe-previous URL.
     *
     * url()->previous() falls back to the Referer header when no session
     * value is set, and the Referer is browser-supplied — meaning a malicious
     * site can populate it with their own URL. Rendering that as the "Go
     * back" button creates an open-redirect / phishing vector.
     *
     * We strip everything but the path (parse_url returns null for malformed
     * input) and re-prepend our origin via url(). The result is always
     * same-origin or '/'.
     */
    $previousPath = parse_url(url()->previous('/'), PHP_URL_PATH) ?: '/';
    $safePrevious = url($previousPath);
@endphp

@section('actions')
    {{-- Plain navigation, not javascript:location.reload() — works no-JS and under strict CSP. --}}
    <a href="{{ $safePrevious }}" class="btn btn-primary">Go back</a>
    <a href="{{ route('login') }}" class="btn btn-ghost">Sign in again</a>
@endsection

@section('signature')
    Nothing was lost — {{ config('app.name', 'RankWizAI') }} just needs a fresh CSRF token before accepting your next move.
@endsection