@@ -2694,9 +2694,10 @@ service, which you can inject in your services or controllers::
2694
2694
}
2695
2695
}
2696
2696
2697
- You can make the signed URI expire. To do so, you can pass a value to the `$expiration ` argument
2698
- of :phpmethod: `Symfony\\ Component\\ HttpFoundation\\ UriSigner::sign `. This optional argument is `null ` by default. You can
2699
- specify an expiration date by several ways::
2697
+ For security reasons, it's common to make signed URIs expire after some time
2698
+ (e.g. when using them to reset user credentials). By default, signed URIs don't
2699
+ expire, but you can define an expiration date/time using the ``$expiration ``
2700
+ argument of :phpmethod: `Symfony\\ Component\\ HttpFoundation\\ UriSigner::sign `::
2700
2701
2701
2702
// src/Service/SomeService.php
2702
2703
namespace App\Service;
@@ -2718,46 +2719,27 @@ specify an expiration date by several ways::
2718
2719
$url = 'https://example.com/foo/bar?sort=desc';
2719
2720
2720
2721
// sign the URL with an explicit expiration date
2721
- $signedUrl = $this->uriSigner->sign($url, new \DateTime ('2050-01-01'));
2722
+ $signedUrl = $this->uriSigner->sign($url, new \DateTimeImmutable ('2050-01-01'));
2722
2723
// $signedUrl = 'https://example.com/foo/bar?sort=desc&_expiration=2524608000&_hash=e4a21b9'
2723
2724
2724
- // check the URL signature
2725
- $uriSignatureIsValid = $this->uriSigner->check($signedUrl);
2726
- // $uriSignatureIsValid = true
2727
-
2728
- // if given a \DateInterval, it will be added from now to get the expiration date
2725
+ // if you pass a \DateInterval, it will be added from now to get the expiration date
2729
2726
$signedUrl = $this->uriSigner->sign($url, new \DateInterval('PT10S')); // valid for 10 seconds from now
2730
2727
// $signedUrl = 'https://example.com/foo/bar?sort=desc&_expiration=1712414278&_hash=e4a21b9'
2731
2728
2732
- // check the URL signature
2733
- $uriSignatureIsValid = $this->uriSigner->check($signedUrl);
2734
- // $uriSignatureIsValid = true
2735
-
2736
- sleep(30); // wait 30 seconds...
2737
-
2738
- // the URL signature has expired
2739
- $uriSignatureIsValid = $this->uriSigner->check($signedUrl);
2740
- // $uriSignatureIsValid = false
2741
-
2742
2729
// you can also use a timestamp in seconds
2743
2730
$signedUrl = $this->uriSigner->sign($url, 4070908800); // timestamp for the date 2099-01-01
2744
2731
// $signedUrl = 'https://example.com/foo/bar?sort=desc&_expiration=4070908800&_hash=e4a21b9'
2745
-
2746
2732
}
2747
2733
}
2748
2734
2749
- .. caution ::
2750
-
2751
- `null ` means no expiration for the signed URI.
2752
-
2753
2735
.. note ::
2754
2736
2755
- When making the URI expire, an ` _expiration ` query parameter is added to the URL and the expiration date is
2756
- converted into a timestamp
2737
+ The expiration date/time is included in the signed URIs as a timestamp via
2738
+ the `` _expiration `` query parameter.
2757
2739
2758
2740
.. versionadded :: 7.1
2759
2741
2760
- The possibility to add an expiration date for a signed URI was introduced in Symfony 7.1.
2742
+ The feature to add an expiration date for a signed URI was introduced in Symfony 7.1.
2761
2743
2762
2744
Troubleshooting
2763
2745
---------------
0 commit comments