Laravel URL Signer

https://github.com/spatie/laravel-url-signer
Admin
Laravel URL Signer creates signed URLs with expiration timestamps for protecting routes and creating...
Tokens:3,955
Snippets:31
Trust Score:10
License:MIT
Update:7 months ago
Show doc for...
Tokens:
Raw
### Install and Configure Laravel URL Signer

Source: https://github.com/spatie/laravel-url-signer/blob/main/README.md

Covers the installation process via Composer, generating the required signature key, and publishing the configuration file.

```bash
composer require spatie/laravel-url-signer
php artisan generate:url-signer-signature-key
php artisan vendor:publish --tag="url-signer-config"
```

--------------------------------

### Run Package Tests

Source: https://github.com/spatie/laravel-url-signer/blob/main/README.md

Command to execute the test suite for the package using Composer.

```bash
composer test
```

--------------------------------

### Configure URL Signer Settings

Source: https://context7.com/spatie/laravel-url-signer/llms.txt

The configuration file defines the signature key, default expiration duration, and the names of the query parameters used for the signature and expiration timestamp.

```php
return [
	'signature_key' => env('URL_SIGNER_SIGNATURE_KEY'),
	'default_expiration_time_in_seconds' => 60 * 60 * 24,
	'parameters' => [
		'expires' => 'expires',
		'signature' => 'signature',
	],
];
```

--------------------------------

### Sign URLs using the UrlSigner Facade

Source: https://context7.com/spatie/laravel-url-signer/llms.txt

Demonstrates how to use the UrlSigner facade to append signature and expiration parameters to URLs. Supports custom expiration times via DateTime objects or integers, as well as cross-application signing with custom keys.

```php
use Spatie\UrlSigner\Laravel\Facades\UrlSigner;

$signedUrl = UrlSigner::sign('https://myapp.com/protected-route');

$signedUrl = UrlSigner::sign('https://myapp.com/protected-route', now()->addDays(30));
$signedUrl = UrlSigner::sign('https://myapp.com/protected-route', now()->addMinutes(5));
$signedUrl = UrlSigner::sign('https://myapp.com/protected-route', now()->addHours(2));

$signedUrl = UrlSigner::sign('https://myapp.com/protected-route', 300);
$signedUrl = UrlSigner::sign('https://myapp.com/protected-route', 60 * 60);

$signedUrl = UrlSigner::sign(
	'https://external-app.com/webhook',
	now()->addHours(1),
	'shared-secret-key-between-apps'
);

$signedUrl = UrlSigner::sign('https://myapp.com/download?file=report.pdf', now()->addMinutes(30));
```

--------------------------------

### Sign and Validate URLs in Laravel

Source: https://github.com/spatie/laravel-url-signer/blob/main/README.md

Demonstrates how to generate a signed URL with a specific expiration time and how to validate the signature of a URL using the UrlSigner facade.

```php
use Spatie\UrlSigner\Laravel\Facades\UrlSigner;

// Sign a URL for 30 days
UrlSigner::sign('https://myapp.com/protected-route', now()->addDays(30));

// Validate a signed URL
UrlSigner::validate('https://app.com/protected-route?expires=xxxxxx&signature=xxxxxx');
```

--------------------------------

### Customizing URL Expiration

Source: https://github.com/spatie/laravel-url-signer/blob/main/README.md

Shows how to sign URLs with custom durations using either Carbon instances or integer values representing seconds.

```php
use Spatie\UrlSigner\Laravel\Facades\UrlSigner;

// Valid for 5 minutes using Carbon
UrlSigner::sign('https://myapp.com/protected-route', now()->addMinutes(5));

// Valid for 5 minutes using seconds
UrlSigner::sign('https://myapp.com/protected-route', 60 * 5);
```

--------------------------------

### Generate Temporary Download, Verification, and Reset Links with Spatie Laravel URL Signer

Source: https://context7.com/spatie/laravel-url-signer/llms.txt

This PHP code demonstrates how to use the Spatie Laravel URL Signer facade to generate signed URLs with specific expiration times for various purposes like file downloads, email verification, and password resets. It requires the 'spatie/laravel-url-signer' package and Laravel's routing and mail components.

```php
use Spatie\UrlSigner\Laravel\Facades\UrlSigner;

// Temporary file download link (valid for 1 hour)
class FileController extends Controller
{
    public function generateDownloadLink(File $file)
    {
        $signedUrl = UrlSigner::sign(
            route('files.download', $file),
            now()->addHour()
        );

        return response()->json(['download_url' => $signedUrl]);
    }

    public function download(File $file)
    {
        // Route is protected by 'signed-url' middleware
        return response()->download(storage_path("app/{$file->path}"));
    }
}

// Email verification link (valid for 24 hours)
class EmailVerificationController extends Controller
{
    public function sendVerificationEmail(User $user)
    {
        $verificationUrl = UrlSigner::sign(
            route('verify.email', ['user' => $user->id]),
            now()->addDay()
        );

        Mail::to($user)->send(new VerifyEmail($verificationUrl));
    }
}

// Password reset link (valid for 60 minutes)
class PasswordResetController extends Controller
{
    public function sendResetLink(Request $request)
    {
        $user = User::where('email', $request->email)->first();
        $token = Str::random(60);

        $resetUrl = UrlSigner::sign(
            route('password.reset', ['token' => $token, 'email' => $user->email]),
            now()->addMinutes(60)
        );

        Mail::to($user)->send(new ResetPasswordMail($resetUrl));
    }
}

// Shareable content link (valid for 7 days)
$shareableLink = UrlSigner::sign(
    route('content.shared', ['id' => $content->id]),
    now()->addWeek()
);

// API endpoint with temporary access
$temporaryApiAccess = UrlSigner::sign(
    "https://api.myapp.com/reports/{$reportId}/export",
    now()->addMinutes(15)
);

```

--------------------------------

### Register and Apply Signed URL Middleware in Laravel

Source: https://github.com/spatie/laravel-url-signer/blob/main/README.md

This snippet demonstrates how to register the ValidateSignature middleware in the HTTP kernel and apply it to specific routes. When applied, the middleware automatically validates the URL signature and returns a 403 error if the signature is invalid.

```php
// in app/Http/Kernel.php

protected $routeMiddleware = [
    // ...
    'signed-url' => \Spatie\UrlSigner\Laravel\Middleware\ValidateSignature::class,
];
```

```php
Route::get('protected-route', fn () => 'Hello secret world!')
    ->middleware('signed-url');
```

--------------------------------

### Cross-Application URL Signing with Shared Secret

Source: https://context7.com/spatie/laravel-url-signer/llms.txt

Enables secure communication between different applications by signing and validating URLs using a shared secret key. This prevents the need to expose internal authentication mechanisms. It's useful for webhooks and external service integrations.

```php
use Spatie\UrlSigner\Laravel\Facades\UrlSigner;

// Application A: Generate signed URL for Application B
$sharedSecret = config('services.app_b.signing_secret');

$webhookUrl = UrlSigner::sign(
    'https://app-b.com/api/webhook/order-created',
    now()->addMinutes(5),
    $sharedSecret
);

// Send webhook to Application B
Http::post($webhookUrl, [
    'order_id' => 12345,
    'amount' => 99.99,
]);

// Application B: Validate incoming webhook
public function handleWebhook(Request $request)
{
    $sharedSecret = config('services.app_a.signing_secret');

    if (!UrlSigner::validate($request->fullUrl(), signatureKey: $sharedSecret)) {
        return response()->json(['error' => 'Invalid signature'], 403);
    }

    // Process the webhook...
    $data = $request->all();

    return response()->json(['status' => 'received']);
}

// Sign external download links
$fileServiceSecret = config('services.file_service.secret');

$signedDownloadUrl = UrlSigner::sign(
    "https://files.example.com/download/{$fileId}",
    now()->addHours(1),
    $fileServiceSecret
);

return view('files.show', ['downloadUrl' => $signedDownloadUrl]);
```

--------------------------------

### Validate Signed URLs with UrlSigner::validate()

Source: https://context7.com/spatie/laravel-url-signer/llms.txt

Validates a signed URL to check for signature integrity and expiration. It returns true if the URL is valid and false otherwise. This method can optionally accept a custom signature key for cross-application validation.

```php
use Spatie\UrlSigner\Laravel\Facades\UrlSigner;

// Basic validation
$isValid = UrlSigner::validate('https://myapp.com/protected-route?expires=1699123456&signature=abc123');
// Returns: true or false

// Validate in a controller
public function download(Request $request)
{
    $isValid = UrlSigner::validate($request->fullUrl());

    if (!$isValid) {
        abort(403, 'Invalid or expired URL');
    }

    // Proceed with download...
    return response()->download($file);
}

// Validate with a custom signature key
$signedUrl = 'https://external-app.com/webhook?expires=1699123456&signature=abc123';

$isValid = UrlSigner::validate($signedUrl, signatureKey: 'shared-secret-key-between-apps');
// Returns: true if signed with the same key

$isWrong = UrlSigner::validate($signedUrl, signatureKey: 'wrong-secret');
// Returns: false

// Check expiration behavior
$signedUrl = UrlSigner::sign('https://spatie.be', now()->addSeconds(2));

sleep(1);
UrlSigner::validate($signedUrl); // Returns: true (still valid)

sleep(2);
UrlSigner::validate($signedUrl); // Returns: false (expired)
```

--------------------------------

### Protect Routes with ValidateSignature Middleware

Source: https://context7.com/spatie/laravel-url-signer/llms.txt

The ValidateSignature middleware automatically protects routes by verifying the signature and expiration of incoming signed URLs. It returns a 403 Forbidden response for invalid or expired URLs. This middleware can be extended for custom error handling.

```php
// Register middleware in app/Http/Kernel.php (Laravel 10 and below)
protected $routeMiddleware = [
    // ... other middleware
    'signed-url' => \Spatie\UrlSigner\Laravel\Middleware\ValidateSignature::class,
];

// Or in bootstrap/app.php (Laravel 11+)
->withMiddleware(function (Middleware $middleware) {
    $middleware->alias([
        'signed-url' => \Spatie\UrlSigner\Laravel\Middleware\ValidateSignature::class,
    ]);
})

// Apply middleware to routes
Route::get('protected-route', fn () => 'Hello secret world!')
    ->middleware('signed-url');

Route::get('download/{file}', [DownloadController::class, 'show'])
    ->middleware('signed-url')
    ->name('download');

// Group protected routes
Route::middleware('signed-url')->group(function () {
    Route::get('secure-file/{id}', [FileController::class, 'download']);
    Route::get('verify-email/{user}', [EmailController::class, 'verify']);
    Route::get('reset-password/{token}', [PasswordController::class, 'reset']);
});

// Generate signed URLs for protected routes
$downloadUrl = UrlSigner::sign(route('download', ['file' => 'report.pdf']), now()->addHours(24));
// User can access this URL for 24 hours

// Custom middleware extending ValidateSignature
namespace App\Http\Middleware;

use Spatie\UrlSigner\Laravel\Middleware\ValidateSignature;

class CustomSignatureValidation extends ValidateSignature
{
    protected function handleUnsignedUrl($request)
    {
        // Custom handling instead of abort(403)
        return redirect()->route('login')
            ->with('error', 'This link has expired. Please request a new one.');
    }
}
```
Tokens:
Raw