Download the PHP package dsentker/url-signature-bundle without Composer

URL Signature Bundle

A Symfony >=4 bundle for the url-signature library.

This bundle allows you to build URLs with a signature in query string to prevent the modification of URL parts form a user. For a more detailed description, view the README from url-signature library .

Features:

• URL generation in Twig Templates
• URL generation and URL validation with a controller helper trait
• URL generation and URL validation with Dependency Injection in your controllers
• URL validation in your controller with Annotation

Installation

Use composer to install this bundle:

If you use Symfony Flex, you do not have to do anything anymore. Otherwise you have to include the bundle in your <root>/config/bundles.php like this:

Usage

Create signed URLs in your Twig Template

This bundle comes with a twig extension to create an url from any route name: signed_url() (and, as alias, signed_path()) works just like the symfony / twig function path() which you have certainly used a hundredfold. signed_path expects a route name as first argument and, optionally, query data as array:

Both links lead to the same target, but the link created via signed_url(...) has a hash in the query string. This hash can be validated in the destination controller.

To set an expiry date for a URL, pass the date as the 3rd parameter:

The expiration value can be

• a relative string (parsable with date() function )
• a \DateTime object
• a timestamp as integer

If the hash value is checked AFTER the expiration time, it is invalid.

Sign URLs in your controller

Use dependency injection to get an instance of Shift\UrlSignatureBundle\Utils\UrlSignatureBuilder:

Verify URLs

This bundle offers several ways to check the signature of the URL in your controller.

Verify a signature with dependency injection (recommended)

Inject an Shift\UrlSignatureBundle\Utils\RequestValidator instance to your action:

Verify a signature with an Annotation

Annotate your controller action like the following example:

If the annotation is present, an Event Listener checks the incoming request URL. If the signature is missing (or invalid), an \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException is thrown before your action is called. Make sure to give the user an useful response if an AccessDeniedException is thrown (This applies regardless of the use of this bundle, of course).

Build hashed URLs and verify signatures with a trait

This bundle comes with a trait to make the access to the Builder and RequestValidator easier::

Note: The trait has its own constructor. If your controller already has a constructor, you should not use this trait. Read more at StackOverflow about "constructor in traits".

Advanced Usage

Customize the configuration

Configuration is already done with the help of the Service Container. To create a signature, a secret is needed. By configuration, this secret is equivalent to the value of your APP_SECRET from the .env file in your project root.

As you know, you can override parameters and dependencies in your config/services.yaml. Here is an example:

Look at the service container configuration file in this repository to see what you want to adjust.

Here is an complete example for the configuration of the hash configuration:

Do not be surprised at the weird looking arguments for the setHashMask method - I did not find a better solution to set a bitmask in a services.yaml.

Submitting bugs and feature requests

Bugs and feature request are tracked on GitHub.

TODO

• [ ] Create more tests. I look forward to every support.
• [ ] Restructure this bundle for the new directory structure coming with Symfony >= 5.0

Testing

Or, if you use Windows: