Please implement a web application in PHP that meets the following requirements:

1. The application must be a single, self-contained .php file.
2. When first accessed, it should display an HTML form with two input fields ("Username" and "Password") and a login button. [0.5p]
3. When the login button is clicked, a POST request should be submitted to the application, containing the entered username and password. [0.5p]
4. Before the form is submitted, client-side JavaScript must validate that both input fields are filled. If either is empty, the form should not be submitted, and a JavaScript alert() message should be shown to the user. [1.5p]
5. If the submitted username is "user" and the password is "pass", the application should treat the session as authenticated and display a "Hello user!" message along with a logout button. [1.5p]
   (Tip: use $_POST, session_start().)
6. The session cookie must use the __Host- prefix. [1p]
   (Tip: use session_name() and session_set_cookie_params().)
7. If the username or password is incorrect, the application should display "Login incorrect!" along with the initial login form. [1p]
8. Clicking the logout button should send a GET request with the query parameter action=logout. The application must then delete the session cookie (using the Set-Cookie header) and redirect the user (using the Location header) back to the login form. [1.5p]
   (Tip: use isset(), $_GET, setcookie() and header().)
9. The application must only handle GET and POST methods. Any other HTTP method must result in an error response with status code 405 and a message in the response body indicating that only GET and POST are supported. [0.5p]
   (Tip: use $_SERVER["REQUEST_METHOD"] and http_response_code().)

Please submit the link to your deployed PHP website and the source code of your .php file below.

Paste a curl one-liner below that can be used to test how your web application rejects HTTP requests that are not GET or POST.

On the websec.ee server, where is PHP session data stored?

How should the vulnerable website https://websec.ee/web/theme/ be fixed to prevent this type of attack?

What attack is possible if a cookie does not have the Domain attribute set but its name does not start with the __Host- prefix?

The website https://www.example.com/ sets a cookie as shown below:

Set-Cookie: session-id=12345; Domain=www.example.com; Path=/; Secure;

Which of the websites listed below will be able to receive this cookie?

1. http://www.example.com/
2. https://www.example.com/
3. https://www.example.com:8787/
4. https://example.com/
5. https://mail.example.com/
6. https://example.mail.com/

The website https://websec.ee/web/theme/ allows users to switch between light and dark themes.

Which of the websites listed in the previous question will be able to inject the cookie?

What attack is possible if a cookie has the Secure attribute set but its name does not start with the __Secure- prefix?

A session identifier included in an authentication cookie must contain a unique value to identify the corresponding browser session.