@@ -2694,9 +2694,10 @@ service, which you can inject in your services or controllers::
26942694 }
26952695 }
26962696
2697- You can make the signed URI expire. To do so, you can pass a value to the `$expiration ` argument
2698- of :phpmethod: `Symfony\\ Component\\ HttpFoundation\\ UriSigner::sign `. This optional argument is `null ` by default. You can
2699- specify an expiration date by several ways::
2697+ For security reasons, it's common to make signed URIs expire after some time
2698+ (e.g. when using them to reset user credentials). By default, signed URIs don't
2699+ expire, but you can define an expiration date/time using the ``$expiration ``
2700+ argument of :phpmethod: `Symfony\\ Component\\ HttpFoundation\\ UriSigner::sign `::
27002701
27012702 // src/Service/SomeService.php
27022703 namespace App\Service;
@@ -2718,46 +2719,27 @@ specify an expiration date by several ways::
27182719 $url = 'https://example.com/foo/bar?sort=desc';
27192720
27202721 // sign the URL with an explicit expiration date
2721- $signedUrl = $this->uriSigner->sign($url, new \DateTime ('2050-01-01'));
2722+ $signedUrl = $this->uriSigner->sign($url, new \DateTimeImmutable ('2050-01-01'));
27222723 // $signedUrl = 'https://example.com/foo/bar?sort=desc&_expiration=2524608000&_hash=e4a21b9'
27232724
2724- // check the URL signature
2725- $uriSignatureIsValid = $this->uriSigner->check($signedUrl);
2726- // $uriSignatureIsValid = true
2727-
2728- // if given a \DateInterval, it will be added from now to get the expiration date
2725+ // if you pass a \DateInterval, it will be added from now to get the expiration date
27292726 $signedUrl = $this->uriSigner->sign($url, new \DateInterval('PT10S')); // valid for 10 seconds from now
27302727 // $signedUrl = 'https://example.com/foo/bar?sort=desc&_expiration=1712414278&_hash=e4a21b9'
27312728
2732- // check the URL signature
2733- $uriSignatureIsValid = $this->uriSigner->check($signedUrl);
2734- // $uriSignatureIsValid = true
2735-
2736- sleep(30); // wait 30 seconds...
2737-
2738- // the URL signature has expired
2739- $uriSignatureIsValid = $this->uriSigner->check($signedUrl);
2740- // $uriSignatureIsValid = false
2741-
27422729 // you can also use a timestamp in seconds
27432730 $signedUrl = $this->uriSigner->sign($url, 4070908800); // timestamp for the date 2099-01-01
27442731 // $signedUrl = 'https://example.com/foo/bar?sort=desc&_expiration=4070908800&_hash=e4a21b9'
2745-
27462732 }
27472733 }
27482734
2749- .. caution ::
2750-
2751- `null ` means no expiration for the signed URI.
2752-
27532735.. note ::
27542736
2755- When making the URI expire, an ` _expiration ` query parameter is added to the URL and the expiration date is
2756- converted into a timestamp
2737+ The expiration date/time is included in the signed URIs as a timestamp via
2738+ the `` _expiration `` query parameter.
27572739
27582740.. versionadded :: 7.1
27592741
2760- The possibility to add an expiration date for a signed URI was introduced in Symfony 7.1.
2742+ The feature to add an expiration date for a signed URI was introduced in Symfony 7.1.
27612743
27622744Troubleshooting
27632745---------------
0 commit comments