{"id":13816389,"url":"https://github.com/psecio/uri","last_synced_at":"2025-04-11T16:26:34.072Z","repository":{"id":57045445,"uuid":"126213893","full_name":"psecio/uri","owner":"psecio","description":"A secure URI generation and validation library","archived":false,"fork":false,"pushed_at":"2018-03-23T02:32:47.000Z","size":12,"stargazers_count":12,"open_issues_count":3,"forks_count":3,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-25T12:41:00.524Z","etag":null,"topics":["security","security-tools","signature","uri","url"],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/psecio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-03-21T17:08:43.000Z","updated_at":"2021-11-29T10:45:45.000Z","dependencies_parsed_at":"2022-08-24T05:31:54.143Z","dependency_job_id":null,"html_url":"https://github.com/psecio/uri","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/psecio%2Furi","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/psecio%2Furi/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/psecio%2Furi/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/psecio%2Furi/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/psecio","download_url":"https://codeload.github.com/psecio/uri/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248439696,"owners_count":21103661,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["security","security-tools","signature","uri","url"],"created_at":"2024-08-04T05:00:39.914Z","updated_at":"2025-04-11T16:26:34.030Z","avatar_url":"https://github.com/psecio.png","language":"PHP","funding_links":[],"categories":["PHP"],"sub_categories":[],"readme":"\n## Psecio\\Uri\n\nA common attack method that pentesters and actual attackers will use is to capture a URL with \"id\" values in it (like `/user/view?id=1234` where `1234` is an ID) and manually change this value to try to bypass authorization checks. While an application should always have some kind of auth check when the URL is called, there's another step that can help to prevent URL changes: a signature value.\n\nThis signature value is built using the contents of the current URL along with a \"secret\" value unique to the application. This signature is then appended to the URL and can be used directly in links. When the URL is used and the request is received, the signature is then checked against the current URL values. If there's no match, the check fails.\n\n### Installation\n\nInstalling via [Composer](https://getcomposer.org) is simple:\n\n```\ncomposer require psecio/uri\n```\n\nThis package only has one dependency, PHPUnit, and that's only a development dependency.\n\n### Signing URLs\n\n```php\n\u003c?php\nrequire_once 'vendor/autoload.php';\n\nuse \\Psecio\\Uri\\Builder;\n\n// Secret is loaded from a configuration outside of the library\n$secret = $_ENV['link_secret'];\n$uri = new \\Psecio\\Uri\\Builder($secret);\n\n$data = [\n    'foo' =\u003e 'this is a test'\n];\n$url = $uri-\u003ecreate('http://test.com', $data);\n// http://test.com?foo=this+is+a+test\u0026signature=90b7ac10b261213f71faaf8ce4008fdbdd037bab7192041de8d54d93a158467f\n?\u003e\n```\n\nIn this example we've created a new `Builder` instance, loaded with the secret value, and are using it to create the URL based on the data and URL provided. The `$url` result has the `signature` value appended to the URL. This value can then be used directly.\n\nYou can also add a signature to a currently existing URL that already has URL parameters using the same `create` method:\n\n```php\n\u003c?php\n// Sign the URL: http://foo.com/user?test=1\n$url = $uri-\u003ecreate('http://foo.com/user?test=1');\n?\u003e\n```\n\n### Verifying URLs\n\nThe other half of the equation is the verification of a URL. The library provides the `validate` method to help with that:\n\n```php\n\u003c?php\n$url = 'http://test.com?foo=this+is+a+test\u0026signature=90b7ac10b261213f71faaf8ce4008fdbdd037bab7192041de8d54d93a158467f';\n\n$valid = $uri-\u003everify($url);\necho 'Is it valid? '.var_export($valid, true).\"\\n\"; // boolean response\n\n?\u003e\n```\n\n### Expiring URLs\n\nThe library also provides the ability to create URLs that will fail validation because they've expired. To make use of this, simply pass in a third value for the `create` method call. This value should either be the number of seconds or a relative string (parsable by PHP's [strtotime](https://php.net/strtotime)) of the amount of time to add:\n\n```php\n\u003c?php\n$data = [\n    'foo' =\u003e 'this is a test'\n];\n$expire = '+10 seconds';\n$url = $uri-\u003ecreate('http://test.com', $data, $expire);\n// http://test.com?foo=this+is+a+test\u0026expires=1521661473\u0026signature=009e2d70add85d79e19979434e3750e682d40a3d1403ee92458fe30aece2c826\n?\u003e\n```\n\nYou'll notice the addition of a new URL parameter, the `expires` value. This value is automatically read when the `validate` call is made to ensure the URL hasn't timed out. If it has, even if the rest of the data is correct, the result will be `false`.\n\nEven if the attacker tries to update the `expires` date to try to extend the length of the hash, the validation will fail as that's not the `expires` value it was originally hashed with.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpsecio%2Furi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpsecio%2Furi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpsecio%2Furi/lists"}