PHPackages                             psecio/uri - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. psecio/uri

ActiveLibrary[Security](/categories/security)

psecio/uri
==========

A secure URI generation and validation library

0.1(8y ago)12123[3 issues](https://github.com/psecio/uri/issues)MITPHP

Since Mar 22Pushed 8y ago4 watchersCompare

[ Source](https://github.com/psecio/uri)[ Packagist](https://packagist.org/packages/psecio/uri)[ Docs](https://github.com/psecio/uri.git)[ RSS](/packages/psecio-uri/feed)WikiDiscussions master Synced 3d ago

READMEChangelogDependencies (1)Versions (2)Used By (0)

Psecio\\Uri
-----------

[](#pseciouri)

A common attack method that pentesters and actual attackers will use is to capture a URL with "id" values in it (like `/user/view?id=1234` where `1234` is an ID) and manually change this value to try to bypass authorization checks. While an application should always have some kind of auth check when the URL is called, there's another step that can help to prevent URL changes: a signature value.

This signature value is built using the contents of the current URL along with a "secret" value unique to the application. This signature is then appended to the URL and can be used directly in links. When the URL is used and the request is received, the signature is then checked against the current URL values. If there's no match, the check fails.

### Installation

[](#installation)

Installing via [Composer](https://getcomposer.org) is simple:

```
composer require psecio/uri

```

This package only has one dependency, PHPUnit, and that's only a development dependency.

### Signing URLs

[](#signing-urls)

```

```

In this example we've created a new `Builder` instance, loaded with the secret value, and are using it to create the URL based on the data and URL provided. The `$url` result has the `signature` value appended to the URL. This value can then be used directly.

You can also add a signature to a currently existing URL that already has URL parameters using the same `create` method:

```

```

You'll notice the addition of a new URL parameter, the `expires` value. This value is automatically read when the `validate` call is made to ensure the URL hasn't timed out. If it has, even if the rest of the data is correct, the result will be `false`.

Even if the attacker tries to update the `expires` date to try to extend the length of the hash, the validation will fail as that's not the `expires` value it was originally hashed with.

###  Health Score

26

—

LowBetter than 43% of packages

Maintenance15

Infrequent updates — may be unmaintained

Popularity14

Limited adoption so far

Community13

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 87.5% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

2976d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e3e9061cdcb718c070419cadac5c58261580bbb384d0c5db21e53501121f08a7?d=identicon)[enygma](/maintainers/enygma)

---

Top Contributors

[![enygma](https://avatars.githubusercontent.com/u/66796?v=4)](https://github.com/enygma "enygma (7 commits)")[![jdreesen](https://avatars.githubusercontent.com/u/424602?v=4)](https://github.com/jdreesen "jdreesen (1 commits)")

---

Tags

securitysecurity-toolssignatureuriurlurivalidategenerate

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/psecio-uri/health.svg)

```
[![Health](https://phpackages.com/badges/psecio-uri/health.svg)](https://phpackages.com/packages/psecio-uri)
```

###  Alternatives

[defuse/php-encryption

Secure PHP Encryption Library

3.9k162.4M214](/packages/defuse-php-encryption)[roave/security-advisories

Prevents installation of composer packages with known security vulnerabilities: no API, simply require it

2.9k97.3M6.4k](/packages/roave-security-advisories)[mews/purifier

Laravel 5/6/7/8/9/10 HtmlPurifier Package

2.0k16.7M113](/packages/mews-purifier)[robrichards/xmlseclibs

A PHP library for XML Security

41278.1M118](/packages/robrichards-xmlseclibs)[bjeavons/zxcvbn-php

Realistic password strength estimation PHP library based on Zxcvbn JS

86917.5M63](/packages/bjeavons-zxcvbn-php)[illuminate/encryption

The Illuminate Encryption package.

9229.7M280](/packages/illuminate-encryption)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)