Still water run deep.
In the latest Laravel 5.6.12 Release a new signed URLs feature was introduced. In this article, we’ll work on enabling signed URLs in an application and look at a few options of how to use them.
First, you’ll need to run composer update laravel/framework in your terminal to pull the latest changes.
Second, you’ll need to add the new ValidateSignature to your route middleware in
That’s it! Now you can start adding signed URLs to your application.
Let’s say we have an event planning application that we let users RSVP to upcoming events. We want to email all users a link so they can quickly respond “yes” or “no” if they are going. However, we don’t want to force them to log into the application again if they happen to be logged out.
Currently, we have the following event.rsvp route in our
and our URL is generated like so
We can see that a curious or malicious user will be easily able to change any variables in the URL, which is far from ideal.
Now that we have a prime candidate for a signed URL let’s add the signature handling.
First, we’ll need to add the signed middleware to our route definition.
Next, we’ll change our
Url::signedRoute() in our application.
Laravel will generate a new signed URL given the route name, and all of the parameters, which generates a URL similar to the following:
Now by using this signed URL if that same “curious” user tries to tamper with the user id, changing it from 100 to 101, or the signature ending with 4 to 5 Laravel will throw an
In addition to just signing a URL, Laravel gives us a great way to add an expiration to a signature as well. If we want the link to expire in 1 hour from generation, we can update our code to the following.
which generates the following: