> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Validating (Secure) URLs!
- URL: https://securinglaravel.com/security-tip-validating-secure-urls/
- Published: 2024-08-29T11:59:38.000Z
- Updated: 2024-08-29T11:59:38.000Z
- Description: [Tip #90] Did you know Laravel's URL validator lets you control which protocols you accept? Here's my recommendation...
- Author: Stephen Rees-Carter
- Tags: Security Tips, Validation, Input Validation, HTTPS

[Laravel's Validator](https://securinglaravel.com/tag/validation/) is an essential piece to preventing unexpected and malicious inputs from making their way into our apps. It includes a long list of built-in validation rules that handle most common scenarios, with options to tweak these rules to refine the validation needed.

Today, we're taking a look at the [url validator](https://laravel.com/docs/11.x/validation?ref=securinglaravel.com#rule-url), which verifies input fields contain valid URLs, and lets you define the allowed protocols for the URLs provided. 

By default, the `url` validator allows anything that looks like a URL:

```php
Validator::make(
    ['link' => "https://evilhacker.dev"], // input
    ['link' => 'url']                     // rule
)->passes();
// => TRUE

Validator::make(
    ['link' => "steam://evilhacker.dev"], // input
    ['link' => 'url']                     // rule
)->passes();
// => TRUE
```

While this may not be an issue in some cases, there are many situations where the user would not expect to click on a user-submitted link in your app and be redirected to some external app.

To get around this, you can tell the validator what protocols are allowed by the validator, for example, we can require `http` and `https` URLs like this:

```php
// INVALID LINK

Validator::make(
    ['link' => "steam://evilhacker.dev"], // input
    ['link' => 'url:http,https']          // rule
)->passes();
// => FALSE

// VALID LINK

Validator::make(
    ['link' => 'http://evilhacker.dev'], // input
    ['link' => 'url:http,https']         // rule
)->passes();
// => TRUE
```

**My recommendation** is to take it a step further, and require HTTPS URLs for all user input, if possible.

This will have the benefit of ensuring all user-submitted links are for secure (i.e. encrypted) sites, and will keep any your users safe from [Downgrade attacks](https://securinglaravel.com/security-tip-how-strict-is-your-transport-security/), etc. This may be incredibly important if your app deals with sensitive or private information (i.e. PII, PHI, etc), and needs to send users to external sites that also need to interact with this data.

```php
// INVALID LINK

Validator::make(
    ['link' => "http://evilhacker.dev"], // input
    ['link' => 'url:https']              // rule
)->passes();
// => FALSE

// VALID LINK

Validator::make(
    ['link' => 'https://evilhacker.dev'], // input
    ['link' => 'url:https']               // rule
)->passes();
// => TRUE
```

**Depending on your business needs, it may not be possible to enforce HTTPS-only for user submitted URLs, but it's worth having that discussion and enforcing it if you can.*

---

## Protect your code, protect your business.

Sign up for [****weekly Laravel Security tips**](https://securinglaravel.com/tag/tips/) and [****monthly In Depth articles**](https://securinglaravel.com/tag/in-depth/) full of indispensable security advice to keep your Laravel applications safe.

Subscribe 

Email sent! Check your inbox to complete your signup. 

No spam. Unsubscribe anytime.