A Laravel signed URL proves the link was not changed after your app created it. It does not prove who is using it. Anyone holding the full link can use it until it expires, so signed URLs suit low risk actions like unsubscribe, and need extra checks for anything sensitive.
How they work
Laravel appends a signature hash to the query string of a named route. When the request arrives, the app recomputes the hash and compares. Change the user id in the link and the signature no longer matches. The docs describe this as protection against URL manipulation for routes that are publicly accessible.
You create one with URL::signedRoute('unsubscribe', ['user' => 1]), and a time limited one with temporarySignedRoute. Validation uses $request->hasValidSignature().
What the signature gives you
| Property | Provided |
|---|---|
| Link has not been edited | Yes |
| Link expires (with temporarySignedRoute) | Yes |
| Link tied to one person | No |
| Link single use | No |
| Link hard to share | No |
The last three are not features of the mechanism. A signed link in a forwarded email works for the recipient of the forward. Signing normally relies on your application key, so test whether links already sent still work after a key rotation.
Good and poor fits
Good fits: unsubscribe links, email verification, temporary downloads, share links meant to be passed around.
Poor fits on their own: password resets, account deletion, payment confirmation, changing an email address. For these, add a second factor to the action, such as requiring the user to be logged in, or a confirmation step that checks a single use token stored server side.
Steps to use them well
- Always use the temporary form for anything with side effects.
- Keep expiry short for sensitive links, longer for harmless ones.
- Check authentication as well when the action touches an account.
- Do not put secrets in the query string, since URLs land in logs, browser history and referrer headers.
- Use
hasValidSignatureWhileIgnoringonly for parameters the front end must add, such as pagination, and keep that list tiny. - After any key rotation, test a link you sent before the change.
Storage links are a cousin
The file storage docs describe Storage::temporaryUrl for the local and S3 drivers, producing a link that expires at a time you set. Treat it the same way: short expiry, and remember the holder of the link has access until then.
Quick check
Can a signed URL be reused?
Yes, until it expires. The signature does not make it single use, so add a server side token for actions that must happen once.
Does the signature hide the data in the URL?
No. It detects changes. The values are still readable in the link.
Safeguard's policy gates and compliance automation can record that such checks are part of your release process. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
