- How do I generate a signed URL for a Laravel route like /download/file?user_id=123
- Use the package’s helper or service provider to create a signed URL. For example, `signed_url('/download/file', ['user_id' => 123])` generates a URL with an HMAC-based signature appended as a query parameter. Ensure your `.env` has `URL_SIGNATURE_SECRET` configured. The package handles hashing automatically, so no manual HMAC logic is needed.
- Can this package validate signed URLs in Laravel middleware?
- Yes, the package includes middleware (e.g., `VerifyUrlSignature`) to validate incoming URLs. Register it in `app/Http/Kernel.php` under the `$routeMiddleware` array. It checks the signature against the stored secret and rejects tampered URLs. This is ideal for securing endpoints like payment callbacks or OAuth redirects.
- What Laravel versions does dsentker/url-signature support?
- The package likely works with Laravel 7–9 (PHP 7.4–8.1). Test it with your target version, as the last release was in 2021. For PHP 8.2+, minor adjustments may be needed due to named argument changes. Check compatibility by reviewing the package’s `composer.json` constraints or running tests against your Laravel setup.
- Does this package support URL expiration (e.g., links that expire after 1 hour)?
- No, the package focuses solely on HMAC-based signature generation and validation. For expiration, you’ll need to manually add an `expires` query parameter and validate it in middleware. Combine it with Laravel’s `Carbon` for time-based checks, e.g., `if (request('expires') < now()->timestamp) abort(403).`
- How do I handle URL encoding issues (e.g., spaces as %20 vs. +)?
- The package uses PHP’s native `http_build_query()` for signature generation, which handles encoding automatically. However, manually constructed URLs (e.g., with `+` instead of `%20`) may fail validation. Ensure consistency by using the package’s helpers for both generation and parsing. For edge cases, pre-process URLs with `rawurldecode()` before validation.
- Is HMAC signing secure enough for payment links or OAuth callbacks?
- HMAC signing provides strong integrity protection against tampering, but security depends on your secret key management. For payment links, pair it with HTTPS and consider additional measures like rate limiting or IP restrictions. Avoid using weak algorithms like SHA-1; configure the package to use SHA-256 via the `hash_algorithm` config option.
- What if the package stops being maintained? Can I fork or replace it?
- Since the package is lightweight (~100 LOC) with no external dependencies, forking is straightforward. Replace it by copying the core logic (HMAC generation/validation) into your app. Alternatives include Laravel’s built-in `hash_hmac()` or packages like `spatie/laravel-honeypot` for broader security needs, though none offer the same URL-specific middleware integration.
- How do I test signed URL generation and validation in Laravel?
- Use PHPUnit or Pest to mock requests with signed URLs. Test both valid and tampered signatures by manually altering the query string. Example: `URL::temporarySignedRoute('download', ['id' => 1], now()->addHour())` for expiration testing. Validate middleware responses (e.g., 403 for invalid signatures) to ensure security.
- Can I use this package for webhook payload validation, not just URLs?
- No, the package is URL-focused and doesn’t handle payload bodies. For webhook validation, use packages like `spatie/laravel-webhooks` or implement HMAC checks manually with `hash_hmac()`. The URL package is best suited for query parameter security, such as redirect URLs or download links.
- How do I integrate this with Laravel Sanctum or Passport for auth?
- Use the package to sign URLs for Sanctum/Passport endpoints (e.g., OAuth redirects). Validate signed URLs in middleware *before* Sanctum/Passport middleware to ensure the URL itself hasn’t been tampered with. For example, protect `/oauth/callback` with `VerifyUrlSignature` to block malicious redirects. The package doesn’t replace Sanctum/Passport but adds an extra layer of URL-level security.