├── .gitattributes ├── .gitignore ├── .styleci.yml ├── CONTRIBUTING.md ├── LICENSE.md ├── README.md ├── composer.json └── src ├── Config └── signed-url.php ├── Facade.php ├── Middleware └── ValidateSignedUrl.php ├── Provider.php └── SignedUrl.php /.gitattributes: -------------------------------------------------------------------------------- 1 | # Set the default behavior, in case people don't have core.autocrlf set. 2 | * text eol=lf 3 | 4 | # Explicitly declare text files you want to always be normalized and converted 5 | # to native line endings on checkout. 6 | *.c text 7 | *.h text 8 | 9 | # Declare files that will always have CRLF line endings on checkout. 10 | *.sln text eol=crlf 11 | 12 | # Denote all files that are truly binary and should not be modified. 13 | *.png binary 14 | *.jpg binary 15 | *.otf binary 16 | *.eot binary 17 | *.svg binary 18 | *.ttf binary 19 | *.woff binary 20 | *.woff2 binary 21 | 22 | *.css linguist-vendored 23 | *.scss linguist-vendored 24 | *.js linguist-vendored 25 | CHANGELOG.md export-ignore 26 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | /vendor 2 | composer.phar 3 | composer.lock 4 | .DS_Store -------------------------------------------------------------------------------- /.styleci.yml: -------------------------------------------------------------------------------- 1 | enabled: 2 | - concat_with_spaces 3 | 4 | disabled: 5 | - concat_without_spaces 6 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing 2 | 3 | Contributions are **welcome** and will be fully **credited**. 4 | 5 | We accept contributions via Pull Requests on [Github](https://github.com/akaunting/signed-url). 6 | 7 | 8 | ## Pull Requests 9 | 10 | - **[PSR-2 Coding Standard](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md)** - The easiest way to apply the conventions is to install [PHP Code Sniffer](http://pear.php.net/package/PHP_CodeSniffer). 11 | 12 | - **Document any change in behaviour** - Make sure the `README.md` and any other relevant documentation are kept up-to-date. 13 | 14 | - **Consider our release cycle** - We try to follow [SemVer v2.0.0](http://semver.org/). Randomly breaking public APIs is not an option. 15 | 16 | - **Create feature branches** - Don't ask us to pull from your master branch. 17 | 18 | - **One pull request per feature** - If you want to do more than one thing, send multiple pull requests. 19 | 20 | - **Send coherent history** - Make sure each individual commit in your pull request is meaningful. If you had to make multiple intermediate commits while developing, please [squash them](http://www.git-scm.com/book/en/v2/Git-Tools-Rewriting-History#Changing-Multiple-Commit-Messages) before submitting. 21 | 22 | 23 | **Happy coding**! 24 | -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) Spatie bvba 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in 13 | all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | THE SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Signed (unique) URL package for Laravel. 2 | 3 | [![Version](https://poser.pugx.org/akaunting/signed-url/v/stable.svg)](https://github.com/akaunting/signed-url/releases) 4 | [![StyleCI](https://styleci.io/repos/102290249/shield?style=flat&branch=master)](https://styleci.io/repos/102290249) 5 | [![Downloads](https://poser.pugx.org/akaunting/signed-url/d/total.svg)](https://github.com/akaunting/signed-url) 6 | [![License](https://poser.pugx.org/akaunting/signed-url/license.svg)](LICENSE.md) 7 | 8 | This package can create URLs with a limited lifetime. This is done by adding an expiration date and a signature to the URL. 9 | 10 | This is how you can create signed URL that's valid for 30 days: 11 | 12 | ```php 13 | SignedUrl::sign('https://myapp.com/protected-route', 30); 14 | ``` 15 | 16 | The output will look like this: 17 | 18 | ``` 19 | https://app.com/protected-route?expires=xxxxxx&signature=xxxxxx 20 | ``` 21 | 22 | The URL can be validated with the `validate`-function. 23 | 24 | ```php 25 | SignedUrl::validate('https://app.com/protected-route?expires=xxxxxx&signature=xxxxxx'); 26 | ``` 27 | 28 | The package also provides [a middleware to protect routes](https://github.com/akaunting/signed-url#protecting-routes-with-middleware). 29 | 30 | ## Installation 31 | 32 | As you would have guessed the package can be installed via Composer: 33 | 34 | ``` 35 | composer require akaunting/signed-url 36 | ``` 37 | 38 | This package intends to provide tools for formatting and conversion monetary values in an easy, yet powerful way for Laravel projects. In older versions of the framework, just add the serviceprovider, and optionally register the facade: 39 | 40 | ```php 41 | // config/app.php 42 | 43 | 'providers' => [ 44 | ... 45 | Akaunting\SignedUrl\Provider::class, 46 | ]; 47 | 48 | 'aliases' => [ 49 | ... 50 | 'SignedUrl' => Akaunting\SignedUrl\Facade::class, 51 | ]; 52 | ``` 53 | 54 | ## Configuration 55 | 56 | The configuration file can optionally be published via: 57 | 58 | ``` 59 | php artisan vendor:publish --provider=signed-url 60 | ``` 61 | 62 | This is the content of the file: 63 | 64 | ```php 65 | return [ 66 | 67 | /* 68 | * This string is used the to generate a signature. You should 69 | * keep this value secret. 70 | */ 71 | 'signatureKey' => env('APP_KEY'), 72 | 73 | /* 74 | * The default expiration time of a URL in days. 75 | */ 76 | 'default_expiration_time_in_days' => 1, 77 | 78 | /* 79 | * These strings are used a parameter names in a signed url. 80 | */ 81 | 'parameters' => [ 82 | 'expires' => 'expires', 83 | 'signature' => 'signature', 84 | ], 85 | 86 | /* 87 | |-------------------------------------------------------------------------- 88 | | Middleware 89 | |-------------------------------------------------------------------------- 90 | | 91 | | This option indicates the middleware to change language. 92 | | 93 | */ 94 | 'middleware' => 'Akaunting\SignedUrl\Middleware\ValidateSignedUrl', 95 | 96 | ]; 97 | ``` 98 | ## Usage 99 | 100 | ### Signing URLs 101 | URL's can be signed with the `sign`-method: 102 | ```php 103 | SignedUrl::sign('https://myapp.com/protected-route'); 104 | ``` 105 | By default the lifetime of an URL is one day. This value can be change in the config-file. 106 | If you want a custom life time, you can specify the number of days the URL should be valid: 107 | 108 | ```php 109 | //the generated URL will be valid for 5 days. 110 | SignedUrl::sign('https://myapp.com/protected-route', 5); 111 | ``` 112 | 113 | For fine grained control, you may also pass a `DateTime` instance as the second parameter. The url 114 | will be valid up to that moment. This example uses Carbon for convenience: 115 | ```php 116 | //This URL will be valid up until 2 hours from the moment it was generated. 117 | SignedUrl::sign('https://myapp.com/protected-route', Carbon\Carbon::now()->addHours(2) ); 118 | ``` 119 | 120 | ### Validating URLs 121 | To validate a signed URL, simply call the `validate()`-method. This return a boolean. 122 | ```php 123 | SignedUrl::validate('https://app.com/protected-route?expires=xxxxxx&signature=xxxxxx'); 124 | ``` 125 | 126 | ### Protecting routes with middleware 127 | The package also provides a middleware to protect routes: 128 | 129 | ```php 130 | Route::get('protected-route', ['middleware' => 'signed', function () { 131 | return 'Hello secret world!'; 132 | }]); 133 | ``` 134 | Your app will abort with a 403 status code if the route is called without a valid signature. 135 | 136 | 137 | ## Changelog 138 | 139 | Please see [Releases](../../releases) for more information what has changed recently. 140 | 141 | ## Contributing 142 | 143 | Please see [CONTRIBUTING](CONTRIBUTING.md) for details. 144 | 145 | ## Security 146 | 147 | If you discover any security related issues, please email security@akaunting.com instead of using the issue tracker. 148 | 149 | ## Credits 150 | 151 | - [Cüneyt Şentürk](https://github.com/cuneytsenturk) 152 | - [Sebastian De Deyne](https://github.com/sebastiandedeyne) 153 | - [All Contributors](../../contributors) 154 | 155 | ## License 156 | 157 | The MIT License (MIT). Please see [LICENSE](LICENSE.md) for more information. 158 | -------------------------------------------------------------------------------- /composer.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "akaunting/signed-url", 3 | "description": "Signed (unique) URL package for Laravel.", 4 | "keywords": [ 5 | "laravel", 6 | "signed", 7 | "url", 8 | "unique", 9 | "unique link", 10 | "unique url" 11 | ], 12 | "license": "MIT", 13 | "authors": [ 14 | { 15 | "name":"Cüneyt Şentürk", 16 | "email":"info@akaunting.com", 17 | "homepage":"https://akaunting.com", 18 | "role":"Developer" 19 | } 20 | ], 21 | "require": { 22 | "php": ">=5.6.0", 23 | "spatie/url-signer": "^1.0.1", 24 | "illuminate/support": ">=5.2 <5.6.12", 25 | "illuminate/http": ">=5.2 <5.6.12" 26 | }, 27 | "autoload": { 28 | "psr-4": { 29 | "Akaunting\\SignedUrl\\": "./src" 30 | } 31 | }, 32 | "extra": { 33 | "laravel": { 34 | "providers": [ 35 | "Akaunting\\SignedUrl\\Provider" 36 | ], 37 | "aliases": { 38 | "SignedUrl": "Akaunting\\SignedUrl\\Facade" 39 | } 40 | } 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /src/Config/signed-url.php: -------------------------------------------------------------------------------- 1 | env('APP_KEY'), 10 | 11 | /* 12 | * The default expiration time of a URL in days. 13 | */ 14 | 'default_expiration_time_in_days' => 30, 15 | 16 | /* 17 | * These strings are used a parameter names in a signed url. 18 | */ 19 | 'parameters' => [ 20 | 'expires' => 'expires', 21 | 'signature' => 'signature', 22 | ], 23 | 24 | /* 25 | |-------------------------------------------------------------------------- 26 | | Middleware 27 | |-------------------------------------------------------------------------- 28 | | 29 | | This option indicates the middleware to change language. 30 | | 31 | */ 32 | 'middleware' => 'Akaunting\SignedUrl\Middleware\ValidateSignedUrl', 33 | 34 | ]; 35 | -------------------------------------------------------------------------------- /src/Facade.php: -------------------------------------------------------------------------------- 1 | validate($request->fullUrl()); 20 | 21 | if (! $urlIsSigned) { 22 | abort(403); 23 | } 24 | 25 | return $next($request); 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /src/Provider.php: -------------------------------------------------------------------------------- 1 | publishes([ 18 | __DIR__ . '/Config/signed-url.php' => config_path('signed-url.php') 19 | ], 'signed-url'); 20 | 21 | $this->app->singleton('signed-url', function () { 22 | return new SignedUrl(); 23 | }); 24 | 25 | $router->aliasMiddleware('signed-url', config('signed-url.middleware')); 26 | 27 | $this->app->alias(SignedUrl::class, 'signed-url'); 28 | } 29 | 30 | /** 31 | * Register the application services. 32 | * 33 | * @return void 34 | */ 35 | public function register() 36 | { 37 | $this->mergeConfigFrom(__DIR__ . '/Config/signed-url.php', 'signed-url'); 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /src/SignedUrl.php: -------------------------------------------------------------------------------- 1 | signatureKey = config('signed-url.signatureKey'); 34 | $this->expiresParameter = config('signed-url.parameters.expires'); 35 | $this->signatureParameter = config('signed-url.parameters.signature'); 36 | } 37 | 38 | /** 39 | * Get a secure URL to a controller action. 40 | * 41 | * @param string $url 42 | * @param \DateTime|int|null $expiration Defaults to the config value 43 | * 44 | * @return string 45 | */ 46 | public function sign($url, $expiration = null) 47 | { 48 | $expiration = $expiration ? $expiration : config('signed-url.default_expiration_time_in_days'); 49 | 50 | return parent::sign($url, $expiration); 51 | } 52 | } 53 | --------------------------------------------------------------------------------