php 验证ajax请求来源

<?php
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (isset($_SESSION['csrf_token']) && $_POST['csrf_token'] === $_SESSION['csrf_token']) {
        // 处理AJAX请求
        echo "请求验证通过";
    } else {
        echo "请求验证失败";
    }
} else {
    // 生成CSRF Token
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    echo $_SESSION['csrf_token'];
}
?>

// 获取CSRF Token
fetch('path/to/php/script.php')
    .then(response => response.text())
    .then(token => {
        // 发送AJAX请求
        fetch('path/to/php/script.php', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json'
            },
            body: JSON.stringify({ csrf_token: token })
        })
        .then(response => response.text())
        .then(data => console.log(data))
        .catch(error => console.error('Error:', error));
    });