The signed URLs utilize one of the core components of Laravel’s security mechanism. It does not matter whether you need to create secure file downloads, email verifications, password reset links, or invitations made via signed URLs. Signed URLs will allow only users who are authenticated to gain access to the respective data.
In this blog, we are going to find out how to use signed URLs in Laravel 13 correctly. We are going to create a download page, which will be invalidated automatically after some time.
Prerequisite:
1. Composer (latest Version)
2. Laravel version 13
Steps to Generate Secure Temporary Links Using Signed URLs in Laravel 13:
Here are the steps to follow:
Step 1: Install Laravel 13
Step 2: Create Controller
Step 3: Create Routes
Step 4: Generate Temporary Signed URL
Step 5: Create Blade File
Step 6: Protect Route Using Signed Middleware
Step 7: Test Project
Let’s outline all steps in detail.
Step 1: Install Laravel 13
We need a new project for this demo. We can create it by using the command given below:
composer create-project laravel/laravel:^13.0 signed-url-demoStep 2: Create Controller
The next step is to create DownloadController. We can create it using the command given below:
php artisan make:controller DownloadControllerapp/Http/Controllers/ProductController.php
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use App\Models\Product;
class DownloadController extends Controller
{
/**
* Display the protected download page.
*/
public function download()
{
return "File downloaded successfully.";
}
}Step 3: Create Routes
The next step is to create routes to generate and access signed URLs.
routes/web.php
<?php
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\URL;
use App\Http\Controllers\DownloadController;
Route::get('/', function () {
$url = URL::temporarySignedRoute(
'download.file',
now()->addMinutes(5)
);
return view('welcome', compact('url'));
});
Route::get('/download', [DownloadController::class, 'download'])
->middleware('signed')
->name('download.file');Step 4: Generate Temporary Signed URL
Generate a permanent signed URL.
$url = URL::signedRoute('download.file');Generate a temporary signed URL.
$url = URL::temporarySignedRoute(
'download.file',
now()->addMinutes(5)
);The generated URL will be similar to the one below.
http://127.0.0.1:8000/downloadexpires=1753458000&signature=7c97d66f83f98c2ab64d2xxxxxxxxxxxxxxxx
Step 5: Create Blade File
The next step is to create a blade file.
resources/views/ welcome.blade.php
<!DOCTYPE html>
<html>
<head>
<title>Laravel Signed URL Example</title>
</head>
<body>
<h2>Laravel 13 Signed URL Example</h2>
<a href="{{ $url }}">
Download Secure File
</a>
</body>
</html>Step 6: Protect Route Using Signed Middleware
Laravel has its signed middleware, which can be used to verify signed URLs.
The below route has already been secured.
routes/web.php
Route::get('/download', [DownloadController::class, 'download'])
->middleware('signed')
->name('download.file');Step 7: Test Project
Now, run the Laravel application.
php artisan serveNow, go to your browser and open the following URL.
http://127.0.0.1:8000/
You will see the following page.
Laravel 13 Signed URL Example
Download Secure File
Click on Download Secure File.
Output:
File downloaded successfully.
Now, wait for five minutes and try opening the same URL again, or manually modify the URL signature.
Laravel will automatically return the following response.
403 | Invalid Signature
This ensures that only authorized users can access protected resources using valid signed URLs.
Conclusion
Laravel 13 makes it easy to secure routes using signed URLs. Whether you want to secure downloaded files, send verification emails, invites, or other sensitive links, this built-in method saves you from looking for additional packages.
FAQ
1. What is a signed URL in Laravel?
A signed URL is characterized by the fact that it contains the cryptographic signature of Laravel itself. Hence, the framework checks whether the signature has been modified and then allows access.
2. What happens if someone modifies a signed URL?
Laravel will identify the signature as invalid and display the 403 Invalid Signature error.
3. Can signed URLs be used to download files?
Of course! Signed URLs are often used to protect the downloadables, invoices, reports, etc from unauthorized persons.
4. Can signed URLs be used for email verification?
Absolutely! Laravel’s email verification feature uses signed URLs in order to ensure that the verification link is protected.
