Generate Temporary Signed URLs in Laravel for Secure Downloads

The Problem: Protecting Private Resources

In many Laravel applications you may want users to access files like:

• Invoice PDFs
• Private reports
• Downloadable resources

But making them publicly accessible is unsafe.

You need secure links that expire automatically.

The Laravel Solution: Temporary Signed URLs

Laravel allows you to generate time-limited signed URLs.

Example:

$url = URL::temporarySignedRoute(
    'download.invoice',
    now()->addMinutes(30),
    ['invoice' => $invoice->id]
);

This link:

• Is valid for 30 minutes
• Cannot be modified
• Contains a secure signature

Route Protection

Now protect the route using the signed middleware.

Route::get('/invoice/{invoice}/download', function () {
    return 'Download invoice';
})->name('download.invoice')->middleware('signed');

If someone changes the URL or uses it after expiration, Laravel automatically blocks it.

Benefits:

• No authentication required
• Time-limited access
• URL tampering protection