Download the PHP package sam-it/yii2-urlsigner without Composer
On this page you can find all versions of the php package sam-it/yii2-urlsigner. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download sam-it/yii2-urlsigner
More information about sam-it/yii2-urlsigner
Files in sam-it/yii2-urlsigner
Package yii2-urlsigner
Short Description Secure URL signing and validation for the Yii2 framework
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package yii2-urlsigner
yii2-urlsigner Secure URL signing and validation.
The goal of this component is to enable stateless but secure URL validation. This can be useful, for example, when doing email validation or password reset.
The idea is simple, consider I want to change my email, the system could send me a link like this:
Of course, this is very insecure, and no one actually (hopefully) does it like this. One solution is to generate a random token:
This is secure, but requires keeping state on the server. This package solves the problem by signing the URL.
This allows us to verify that the URL was actually created by us therefore can be trusted.
Example
Do not share secrets across hosts
If you use this component in a multi-host application you must make sure each host uses a different secret. The URL signing takes into account the absolute route and all given parameters, anything else is excluded from the signature and from validation. This means that if you have a structure like this:
And they use the same route, for example /user/do-reset, for password resets, a normal user will be able to change the domain without invalidating the signature.
