Weave Code
Url Signer Laravel Package
spatie/url-signer
spatie/url-signer creates URLs with a limited lifetime by adding an expiration date and signature, then validates them later. Sign and verify links using a secret key with Sha256 or custom signers.
Generate a url with an expiration date and signature to prevent unauthorized access
Frequently asked questions about Url Signer
- How do I install spatie/url-signer in a Laravel app?
- Install it with composer require spatie/url-signer. In Laravel, configure the signing key in your .env file, for example URL_SIGNER_KEY, then resolve the UrlSigner facade or app(UrlSigner::class) from the service container. Usage is typically two to three lines per signed URL plus a small amount of configuration.
- What PHP and Laravel versions does spatie/url-signer 2.2.0 require?
- Version 2.2.0 requires PHP 8.2 or newer. In practice that means Laravel 10.2+ on PHP 8.2, or Laravel 11/12; Laravel 9 and early Laravel 10 deployments on PHP 8.1 cannot use 2.2.0. The only 2.2.0 change is dropping PHP 8.1 support, with no API, config, or signing behavior changes. If you must stay on PHP 8.1, pin spatie/url-signer to 2.1.4.
- How do I create a signed URL that expires after 30 seconds or a custom TTL?
- Use Sha256UrlSigner with a secret key and call sign($url, $ttlInSeconds), for example sign('https://myapp.com', 30) for a 30-second lifetime. The result includes expires and signature query parameters. In Laravel, resolve app(UrlSigner::class) or the UrlSigner facade and use the same sign call. Use UTC timestamps when calculating TTLs to avoid clock-skew and timezone problems.
- How does spatie/url-signer validate signed URLs and handle expired or tampered links?
- The validate method returns true only when the URL expiration timestamp is in the future and the signature matches the expected value. Expired links and links with modified query parameters or signatures return false. In Laravel middleware you can call validate($request->fullUrl()) and abort(403) when it fails. Validate the full URL exactly as it was signed, because changing query parameters changes the signature.
- Can I use spatie/url-signer outside Laravel or with a custom signer?
- Yes. The standalone Sha256UrlSigner accepts a secret key and can sign and validate URLs without Laravel. The package also supports custom signers, so you can implement a different signing strategy while keeping the same sign and validate flow. In Laravel you can bind your signer in the service container and resolve it through the UrlSigner facade.
- Where should I store the URL signer secret key in Laravel?
- Store the signing secret in Laravel's .env file, for example URL_SIGNER_KEY, and never commit it to source control. Keep it out of client-side code and use your normal config cache and secret-management process. Plan key rotation carefully because URLs signed with an old key will fail validation unless you support multiple keys during a transition.
- How do I protect routes with signed URLs using Laravel middleware?
- Create middleware that checks the request for a signature parameter, resolves app(UrlSigner::class), and calls validate on $request->fullUrl(). If validation fails, abort with 403 or redirect as appropriate. Register the middleware on routes that serve downloads, invitations, or other time-sensitive resources. Keep the check in Laravel's request pipeline so expired and tampered links never reach your controller.
- What changed in spatie/url-signer 2.2.0 and will composer update break PHP 8.1?
- 2.2.0 only drops PHP 8.1 support; signing, validation, key handling, and the public API are unchanged. A routine composer update on a PHP 8.1 host can still fail or select an incompatible version because the platform requirement changed under a minor release. Pin spatie/url-signer to 2.1.4 exactly on PHP 8.1 services, and prefer ~2.1.0 over ^2.1 to avoid an automatic jump. Enforce composer.lock in deploys and add a CI gate that fails on PHP requirement conflicts.
- How do I test signed URL generation and validation in PHPUnit?
- Mock UrlSigner in PHPUnit when testing controllers so you can assert that invalid signatures produce a 403 without generating real URLs. Add integration tests for valid URLs, expired URLs, and tampered signatures. Use a fixed clock or Laravel time travel if your tests depend on expiration boundaries. Keep the CI matrix on PHP 8.2 and 8.3 so the 2.2.0 runtime constraint is enforced in code.
- What are alternatives to spatie/url-signer for temporary signed URLs in Laravel?
- AWS presigned URLs are a good fit only if you already use S3 and need S3-style temporary access; they are overkill for internal Laravel apps. Laravel's signed route model binding handles route-based signed URLs but is limited to routes rather than arbitrary URLs. Custom middleware can work but usually means more boilerplate than spatie/url-signer. Choose spatie/url-signer when you want a lightweight, stateless signer for arbitrary Laravel or PHP URLs.
Weaver
How can I help you explore Laravel packages today?