What are Signed URLs in Laravel, and when are they used to protect sensitive operations?

Short answer

They contain a digital signature (HMAC Hash) that prevents parameter tampering and can have an expiration time; use them for email verification and account recovery.

Explanation

Signed URLs prevent users from changing URL parameters. If a URL activates account /verify/123 and a user changes the number to 124, the signature becomes invalid and the server returns 403 Invalid Signature. URL::temporarySignedRoute() sets an expiration period (such as 30 minutes); the signed Middleware validates it on the route.

Code example

$url = URL::temporarySignedRoute(
    'unsubscribe', now()->addMinutes(30), ['user' => $user->id]
);

Common mistakes

• Relying on unsigned activation routes that let users activate other accounts by guessing IDs.

Follow-up questions

• How does Laravel hash passwords with the Hash Facade?

Sources

• Laravel docs — Signed URLs