PHPackages                             tilleuls/url-signer-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. tilleuls/url-signer-bundle

ActiveSymfony-bundle[Security](/categories/security)

tilleuls/url-signer-bundle
==========================

Create and validate signed URLs with a limited lifetime in Symfony

v2.2.3(4mo ago)81369.3k↓37.7%5[1 PRs](https://github.com/coopTilleuls/UrlSignerBundle/pulls)MITPHPPHP >=8.1CI failing

Since Jan 26Pushed 4mo ago13 watchersCompare

[ Source](https://github.com/coopTilleuls/UrlSignerBundle)[ Packagist](https://packagist.org/packages/tilleuls/url-signer-bundle)[ RSS](/packages/tilleuls-url-signer-bundle/feed)WikiDiscussions main Synced 3d ago

READMEChangelogDependencies (37)Versions (12)Used By (0)

UrlSignerBundle
===============

[](#urlsignerbundle)

[![Packagist Version](https://camo.githubusercontent.com/6877063030762111cd17a4dc097aa6114668bf83869e7eccbdc8dd6f605baa77/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f74696c6c65756c732f75726c2d7369676e65722d62756e646c652e737667)](https://packagist.org/packages/tilleuls/url-signer-bundle)[![Actions Status](https://github.com/coopTilleuls/UrlSignerBundle/workflows/CI/badge.svg)](https://github.com/coopTilleuls/UrlSignerBundle/actions)[![Coverage Status](https://camo.githubusercontent.com/86996cd2447f9568e918a35f215fba39e20beb639ccc1c45c54774e4e38fa9f0/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f636f6f7054696c6c65756c732f55726c5369676e657242756e646c652f62616467652e7376673f6272616e63683d6d61696e)](https://coveralls.io/github/coopTilleuls/UrlSignerBundle?branch=main)[![Infection MSI](https://camo.githubusercontent.com/fb64af75f35eb2f186375dce9f209e3c868864de81bcf9ae80854d8f584189d1/68747470733a2f2f696d672e736869656c64732e696f2f656e64706f696e743f75726c3d687474707325334125324625324662616467652d6170692e737472796b65722d6d757461746f722e696f2532466769746875622e636f6d253246636f6f7054696c6c65756c7325324655726c5369676e657242756e646c652532466d61696e)](https://dashboard.stryker-mutator.io/reports/github.com/coopTilleuls/UrlSignerBundle/main)[![Type Coverage](https://camo.githubusercontent.com/8b2e4a6a0fdcebb4f3424a46e6ba95d6aec00c56cff9a091e880ebc517d94264/68747470733a2f2f73686570686572642e6465762f6769746875622f636f6f7054696c6c65756c732f55726c5369676e657242756e646c652f636f7665726167652e737667)](https://shepherd.dev/github/coopTilleuls/UrlSignerBundle)

Create and validate signed URLs with a limited lifetime in Symfony.

This bundle is based on [spatie/url-signer](https://github.com/spatie/url-signer).

Installation
------------

[](#installation)

Make sure Composer is installed globally, as explained in the [installation chapter](https://getcomposer.org/doc/00-intro.md)of the Composer documentation.

Open a command console, enter your project directory and execute:

```
composer require tilleuls/url-signer-bundle
```

**If you're using [Symfony Flex](https://github.com/symfony/flex), all configuration is already done. You can customize it in `config/packages/url_signer.yaml` file.**

Otherwise, enable the bundle by adding it to the list of registered bundles in the `config/bundles.php` file of your project:

```
// config/bundles.php

return [
    // ...
    CoopTilleuls\UrlSignerBundle\CoopTilleulsUrlSignerBundle::class => ['all' => true],
];
```

Configuration
-------------

[](#configuration)

Add a signature key (as environment variable):

```
# config/packages/url_signer.yaml
coop_tilleuls_url_signer:
    signature_key: '%env(string:SIGNATURE_KEY)%'
```

In dev mode, you can use an `.env` file:

```
# .env (or .env.local)
SIGNATURE_KEY=your_signature_key
```

You can change the signer used to create the signature:

```
# config/packages/url_signer.yaml
coop_tilleuls_url_signer:
    signer: 'md5' # 'sha256' by default
```

The default expiration time can be changed too.

In seconds:

```
# config/packages/url_signer.yaml
coop_tilleuls_url_signer:
    default_expiration: 3600 # 86400 by default
```

With a date/time string:

```
# config/packages/url_signer.yaml
coop_tilleuls_url_signer:
    default_expiration: '1 day'
```

You can also customize the URL parameter names:

```
# config/packages/url_signer.yaml
coop_tilleuls_url_signer:
    expires_parameter: 'exp' # 'expires' by default
    signature_parameter: 'sign' # 'signature' by default
```

Usage
-----

[](#usage)

### Generate a Signed URL

[](#generate-a-signed-url)

To create a temporary signed URL for a route, you first need to inject the URL signer to your service or controller:

```
// src/Controller/DocumentController.php
namespace App\Controller;

use CoopTilleuls\UrlSignerBundle\UrlSigner\UrlSignerInterface;

class DocumentController
{
    public function __construct(
        private UrlSignerInterface $urlSigner,
    ) {}
}
```

If autowiring is enabled (the default Symfony configuration) in your application, you have nothing more to do.

Otherwise, inject the `url_signer.signer` service in the configuration:

```
# config/services.yaml
services:
    App\Controller\DocumentController:
        arguments:
            $urlSigner: '@url_signer.signer'
```

You can now use the URL signer to generate a signed path or a signed URL:

```
// src/Controller/DocumentController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;

class DocumentController extends AbstractController
{
    private function generateSignedUrl(): string
    {
        // Or $url = $this->generateUrl('secured_document', ['id' => 42], UrlGeneratorInterface::ABSOLUTE_URL);
        $url = $this->generateUrl('secured_document', ['id' => 42]);
        // Will expire after one hour.
        $expiration = (new \DateTime('now'))->add(new \DateInterval('PT1H'));
        // An integer can also be used for the expiration: it will correspond to a number of seconds. For 1 hour:
        // $expiration = 3600;

        // Not passing the second argument will use the default expiration time (86400 seconds by default).
        // return $this->urlSigner->sign($url);

        // Will return a path like this: /documents/42?expires=1611316656&signature=82f6958bd5c96fda58b7a55ade7f651fadb51e12171d58ed271e744bcc7c85c3
        // Or a URL depending on what has been signed before.
        return $this->urlSigner->sign($url, $expiration);
    }
}
```

### Validate Signed Route Requests

[](#validate-signed-route-requests)

To deny access to a route if the signature is not valid, add a `_signed` [extra parameter](https://symfony.com/doc/current/routing.html#extra-parameters) to the route configuration:

```
# config/routes.yaml
secured_document:
    path: /documents/{id}
    controller: App\Controller\DocumentController::index
    defaults:
        _signed: true
```

If the signature is invalid (bad signature or expired URL), the request will receive a 403 response (access denied).

Custom Signer
-------------

[](#custom-signer)

If you need to use a specific hash algorithm for generating the signature, you can create your own signer.

Create a class extending the `AbstractUrlSigner` class:

```
// src/UrlSigner/CustomUrlSigner.php
namespace App\UrlSigner;

use CoopTilleuls\UrlSignerBundle\UrlSigner\AbstractUrlSigner;

class CustomUrlSigner extends AbstractUrlSigner
{
    public static function getName(): string
    {
        return 'custom';
    }

    protected function createSignature(string $url, string $expiration, string $signatureKey): string
    {
        return hash_hmac('algo', "{$url}::{$expiration}", $signatureKey);
    }
}
```

If autoconfiguring is enabled (the default Symfony configuration) in your application, you are done.

Otherwise, register and tag your service:

```
# config/services.yaml
services:
    App\UrlSigner\CustomUrlSigner:
        # You don't need to specify the arguments
        tags: ['url_signer.signer']
```

You can now use your custom signer:

```
# config/packages/url_signer.yaml
coop_tilleuls_url_signer:
    signer: 'custom'
```

Credits
-------

[](#credits)

Created by [Alan Poulain](https://github.com/alanpoulain) for [Les-Tilleuls.coop](https://les-tilleuls.coop/).

###  Health Score

58

—

FairBetter than 98% of packages

Maintenance77

Regular maintenance activity

Popularity49

Moderate usage in the ecosystem

Community21

Small or concentrated contributor base

Maturity69

Established project with proven stability

 Bus Factor1

Top contributor holds 87.7% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~185 days

Recently: every ~225 days

Total

11

Last Release

128d ago

Major Versions

v1.2.0 → v2.0.02023-03-15

PHP version history (2 changes)v1.0.0PHP >=7.4

v2.0.0PHP >=8.1

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/57224?v=4)[Kévin Dunglas](/maintainers/dunglas)[@dunglas](https://github.com/dunglas)

![](https://www.gravatar.com/avatar/da08ebc4ac8aac1a8fac352d831d1b610913edbb5099252e02361081b5b8a066?d=identicon)[Alan Poulain](/maintainers/Alan%20Poulain)

---

Top Contributors

[![alanpoulain](https://avatars.githubusercontent.com/u/10920253?v=4)](https://github.com/alanpoulain "alanpoulain (50 commits)")[![thbil](https://avatars.githubusercontent.com/u/11739744?v=4)](https://github.com/thbil "thbil (2 commits)")[![natepage](https://avatars.githubusercontent.com/u/11576446?v=4)](https://github.com/natepage "natepage (1 commits)")[![pauljosephkrogulec](https://avatars.githubusercontent.com/u/42961012?v=4)](https://github.com/pauljosephkrogulec "pauljosephkrogulec (1 commits)")[![simonjamain](https://avatars.githubusercontent.com/u/6118295?v=4)](https://github.com/simonjamain "simonjamain (1 commits)")[![norkunas](https://avatars.githubusercontent.com/u/2722872?v=4)](https://github.com/norkunas "norkunas (1 commits)")[![MatTheCat](https://avatars.githubusercontent.com/u/1898254?v=4)](https://github.com/MatTheCat "MatTheCat (1 commits)")

---

Tags

encryptionsecuritysignsymfonysymfony-bundleurlurlsymfonysecurityencryptionsign

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan, Psalm

Code StylePHP CS Fixer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/tilleuls-url-signer-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/tilleuls-url-signer-bundle/health.svg)](https://phpackages.com/packages/tilleuls-url-signer-bundle)
```

###  Alternatives

[symfony/framework-bundle

Provides a tight integration between Symfony components and the Symfony full-stack framework

3.6k251.7M11.6k](/packages/symfony-framework-bundle)[easycorp/easyadmin-bundle

Admin generator for Symfony applications

4.3k17.9M388](/packages/easycorp-easyadmin-bundle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)