> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Don't Forget to Test Your Signed URLs!
- URL: https://securinglaravel.com/security-tip-dont-forget-to-test-your-signed-urls/
- Published: 2024-08-10T03:00:34.000Z
- Updated: 2024-08-10T03:00:33.000Z
- Description: [Tip #88] Signed URLs are awesome, but if you forget to check they are working - you may be leaving a massive vulnerability just waiting to be exploited...
- Author: Stephen Rees-Carter
- Tags: Security Tips, Testing, Signed URLs

[Signed URLs](https://securinglaravel.com/in-depth-signed-urls/) are one of my favourite Laravel features, and [I've written about them many times](https://securinglaravel.com/tag/signed-urls/), however, there is one aspect I don't believe I've covered yet: **Testing!**

We all know we should be writing tests alongside our code, but are you just testing the "*happy-path*" (i.e. only successful results), or **are you checking failure states too?** 

It's important to check all the failure states you can think of. This means checking for failing validation, failing authorisation, invalid inputs, and even modified URLs.

As such, when it comes to testing your routes which use Signed URLs, make sure you:

1. **Check any URLs or redirects are correctly generating Signed URLs.**

To make testing redirects easier, you can use Laravel's `assertRedirectToSignedRoute()` assertion to check Signed URLs are correctly generated. ([docs](https://laravel.com/docs/http-tests?ref=securinglaravel.com#assert-redirect-to-signed-route))

1. **Check the routes which should be signed are actually validating the signature.**

Make sure you test requests with modified signatures, missing signatures, and modified parameters, and ensure you get an `403` response any time an invalid URL is provided.

🧐

**I always check for Signed URLs when conducting a* [**Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com&utm%5Fcampaign=tip88)**, as I'll occasionally find routes which are missing the signature verification from the target route - allowing me to spoof URLs and get up to some mischief.*

---

## Protect your code, protect your business.

Sign up for [****weekly Laravel Security tips**](https://securinglaravel.com/tag/tips/) and [****monthly In Depth articles**](https://securinglaravel.com/tag/in-depth/) full of indispensable security advice to keep your Laravel applications safe.

Subscribe 

Email sent! Check your inbox to complete your signup. 

No spam. Unsubscribe anytime.