Laravel URL Signing

Sign media URLs with your Laravel application's signing key so Lasso can securely display your private content.

Our Laravel URL signing integration allows Lasso to securely access media that your Laravel application serves behind signed URLs. Lasso signs URLs the same way Laravel's URL::temporarySignedRoute does, so your application can validate them with $request->hasValidSignature(). No credentials are exchanged at request time, your application stays in control of every download.

URL signing is available as an add-on. Contact us to enable it for your workspace.

Step 1: Prepare Your Laravel Application

1. Serve your media through a route that validates signed URLs, for example:

   Route::get('/media/{path}', [MediaController::class, 'show'])
       ->where('path', '.*')
       ->middleware(ValidateSignature::class);

   The route must allow both GET and HEAD requests. Lasso uses HEAD requests to check content before downloading it.

2. Choose the signing key you will share with Lasso. This can be your APP_KEY, but we recommend a dedicated key so you do not have to share your application key. On Laravel 11 and newer, register a key resolver that returns both keys, so your own signed routes (password resets, unsubscribe links) keep working:

   // app/Providers/AppServiceProvider.php
   public function boot(): void
   {
       URL::setKeyResolver(fn () => [
           config('app.key'),
           config('services.lasso.signing_key'),
       ]);
   }

   On Laravel 10 and older the key resolver returns a single key, so validate the dedicated Lasso key in middleware scoped to the media route instead. Sharing your APP_KEY also works, but only do so if you understand the implications: anyone holding that key can forge signatures for every signed route in your application (password resets, unsubscribe links), not just media URLs.

The signing key is used exactly as written. If your key starts with base64:, that prefix is part of the key, Laravel never decodes it. Copy the key verbatim when adding it to Lasso.

Step 2: Add Signing Information in Lasso

1. Navigate to Settings → Integrations in Lasso.

2. Select Laravel Signatures, click New signature and fill in the following fields:

   • Domain: The domain where your content resides (e.g. https://media.your-platform.com). Every URL on this domain will be signed.

   • Signing key: The key your application validates signed URLs with. It is stored encrypted and never shown again, only a masked hint appears in the dashboard.

   • TTL: The time-to-live for the signed URL (minimum 15 minutes). This is the amount of time a URL will be valid for.

   • Example URL: Provide an example URL on your domain. Lasso signs it and requests it with GET and HEAD to verify your application accepts the signature. The signature is only saved when both requests succeed.

Step 3: Automatic Signing for Your Content

Once the integration is set up:

• Any content from the specified Domain will automatically be signed by Lasso when required.

• Lasso appends two query parameters to the URL: expires (a Unix timestamp) and signature (a lowercase hex HMAC-SHA256 over the URL, computed the same way Laravel computes it). Existing query parameters are preserved.

• The signed URL is used for analyzing the content or displaying it securely in the dashboard. You do not need to update or manage URLs manually.

• If the signed URL expires, Lasso regenerates it automatically when the content is accessed again.