Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

lararara's avatar

How to Validate a HTTP Referer with Request()->hasValidSignature?

I have a temporary signed url which I use to allow logged in users, who don't own the room gain access. So anyone with the link can access the room. This page has a websocket where only the user who owns the room, or anyone who has a valid temp signed url can access.

The issue is that the websocket auth url is http:://localhost/broadcasting/auth and this is not a valid request signature. The HTTP_REFERER contains the valid temp signed url.

How can I validate my http referer's url instead of the current broadcast auth url?

// channels
Broadcast::channel('room.{room}', static function (User $user, Room $room) {
    return $user->can('view', $room);
});

// RoomPolicy
    public function view(User $user, Room $Room): bool
    {

		// Only the broadcast auth has a HTTP_REFERER
        $request = Request();
        $httpReferer = $request->server('HTTP_REFERER');

		// Try to set the url and see if that will validate. It doesn't
        if ($httpReferer) {
            $request->replace([
                'url' => $httpReferer,
            ]);
            $validSign = $request->hasValidSignature(true);
        }

		// This will work for the initial page load, as the user has the correct temp signed url
		// But will fail when trying to auth the broadcast channel, since that is not the signed url created 
        return Request()->hasValidSignature() || $room->user_id === $user->id;
    }

I was thinking I'd need to mimic how the valid signature is checked vendor/laravel/framework/src/Illuminate/Routing/UrlGenerator.php and replace the current request with all those details.

Or reimplement the hasValidSignature except with just the http_referer url

0 likes
1 reply
lararara's avatar
lararara
OP
Best Answer
Level 2

I think it's best to just use spatie url signer instead. The native url signer is bound to the request itself and is the core assumption in everything.

Just setting the request url to the http_referer signed url is not enough, it also checks query params and a few others.

In my case, because I'm using the temporary signed url both as a route and also as a broadcast auth guard, it won't work without a lot of wrangling. The spatie url signer can make a temporary signed url, to protect the route so only those with the link can access it. And then be the HTTP referer url send via broadcast auth and validated.

Please or to participate in this conversation.