The second edition of <a href="https://api-platform.com/con/2022/" target="_blank" rel="noreferrer noopener">API Platform Conference</a> is around the corner! Join us on Thursday 15 and Friday 16 September in Lille and online. Two stages are scheduled in French and in English. Both of them will be broadcasted live on Livestorm. 



<h2>An intensive week of knowledge sharing </h2>



Let&rsquo;s see together <a href="https://api-platform.com/con/2022/" target="_blank" rel="noreferrer noopener">a sneak peek of the conference schedule!</a> 



<ul><li><a href="https://api-platform.com/con/2022/conferences/php-websockets-or-how-to-communicate-with-clients-in-real-time/" target="_blank" rel="noreferrer noopener">Pauline Vos</a> will speak about&nbsp;PHP Websockets</li><li><a href="https://api-platform.com/con/2022/conferences/dilemmas-and-decisions-what-we-ve-learned-designing-the-new-sylius-api/" target="_blank" rel="noreferrer noopener">Lukasz Chrusciel</a> will share news from Sylius&rsquo; new API</li><li><a href="https://api-platform.com/con/2022/conferences/domain-driven-design-with-api-platform-3/" target="_blank" rel="noreferrer noopener">Robin Chalas and Mathias Arlaud</a> will speak about DDD with API Platform 3</li><li><a href="https://api-platform.com/con/2022/conferences/gerer-les-operations-sequentielles-avec-REST/" target="_blank" rel="noreferrer noopener">Grégoire Hébert</a> will show you how to manage sequential operations with REST&nbsp;</li><li><a href="https://api-platform.com/con/2022/conferences/building-schema-first-event-driven-architectures-with-async-api/" target="_blank" rel="noreferrer noopener">Fran Mendez</a> will present schema-first event-driven architectures with AsyncAPI</li><li><a href="https://api-platform.com/con/2022/conferences/API-platform-au-quotidien-dans-une-entreprise-e-commerce-et-logistique/" target="_blank" rel="noreferrer noopener">Kévin Verschaeve and Clément Sanchez</a> will show how API Platform works in the daily life of an e-commerce and logistics company</li><li><a href="https://api-platform.com/con/2022/conferences/decentralizaion-query-apis-and-other-myths/" target="_blank" rel="noreferrer noopener">Ruben Verborgh</a> will speak about decentralization, query APIs and other myths</li><li><a href="https://api-platform.com/con/2022/conferences/la-revue-de-code-est-un-art/" target="_blank" rel="noreferrer noopener">Smaïne Millianni</a> will present a talk about code review</li><li><a href="https://api-platform.com/con/2022/conferences/fighting-impostor-syndrome-a-pratical-handbook/" target="_blank" rel="noreferrer noopener">Marine Gandy</a> will talk about impostor syndrome</li><li><a href="https://api-platform.com/con/2022/conferences/what-s-new-in-caddy-the-webserver-of-api-platform/" target="_blank" rel="noreferrer noopener">Francis Lavoie</a> will show you what&rsquo;s new in Caddy, API Platform&rsquo;s webserver</li><li><a href="https://api-platform.com/con/2022/conferences/webauthn-se-debarrasser-des-mots-de-passe-definitivement/">Florent Morselli</a> will share thoughts about&nbsp;Webauthn</li></ul>



More speakers are announced on <a href="https://api-platform.com/con/2022/schedule" target="_blank" rel="noreferrer noopener">our website</a>!



Interested in getting trained about API Platform? <a href="https://api-platform.com/con/2022/schedule" target="_blank" rel="noreferrer noopener">Two workshops are also available</a>:



<ul><li>Tuesday 13/09: <a href="https://api-platform.com/con/2022/conferences/designing-and-building-an-api-first-project-with-API-Platform-3/" target="_blank" rel="noreferrer noopener">Design and development of a 1st API project with API Platform 3,</a> with <a href="https://twitter.com/dunglas" target="_blank" rel="noreferrer noopener">Kévin Dunglas</a> and <a href="https://twitter.com/s0yuka" target="_blank" rel="noreferrer noopener">Antoine Bluchet</a></li><li>Wednesday 14/09: <a href="https://api-platform.com/con/2022/conferences/workshop-domain-driven-design-with-API-Platform-3/" target="_blank" rel="noreferrer noopener">Domain Driven Design with API Platform 3</a>, with <a href="https://twitter.com/chalas_r" target="_blank" rel="noreferrer noopener">Robin Chalas</a> and <a href="https://twitter.com/matarld" target="_blank" rel="noreferrer noopener">Mathias Arlaud</a></li></ul>



When you register to the on-site conference, you can also join our <a href="https://api-platform.com/con/2022/conferences/API-platform-3-hack-day/" target="_blank" rel="noreferrer noopener">hackday</a> planned on Saturday 17/09. It&rsquo;s free and it will be hosted by Kévin Dunglas and Antoine Bluchet in our office.



Moreover, we also remind you that all tickets are free for student or job seekers. <a href="mailto:events@les-tilleuls.coop" target="_blank" rel="noreferrer noopener">Contact our team</a> to get your voucher.



<h2>Thanks to our partners</h2>



This event would not have been possible without our partners support! Many thanks to <a href="https://www.francetelevisions.fr/" target="_blank" rel="noreferrer noopener nofollow">France Télévisions</a>, <a href="https://sensiolabs.com/fr/" target="_blank" rel="noreferrer noopener nofollow">Sensiolabs</a>, <a href="https://www.alicesgarden.fr/" target="_blank" rel="noreferrer noopener nofollow">Alice&rsquo;s Garden</a>, <a href="https://link-value.fr/" target="_blank" rel="noreferrer noopener nofollow">Linkvalue</a>, <a href="https://platform.sh/" target="_blank" rel="noreferrer noopener nofollow">Platform.sh</a>, <a href="https://www.apimatic.io/" target="_blank" rel="noreferrer noopener nofollow">APImatic</a> and <a href="https://fairness.coop/" target="_blank" rel="noreferrer noopener nofollow">Fairness</a> for contributing to the organization of this event! Want to be a partner? Some slots are still available: <a href="mailto:events@les-tilleuls.coop" target="_blank" rel="noreferrer noopener">contact us to get the sponsorship brochure</a>. 







We are really excited to meet you both online and in Lille for <a href="https://les-tilleuls.coop/en/blog/api-platform-conference-2021-a-successful-edition" target="_blank" rel="noreferrer noopener">this second edition</a>! Still not registered? <a href="https://api-platform.com/con/2021/#pricing" target="_blank" rel="noreferrer noopener">Late bird tickets are still available.</a> See you soon!

API Platform Conference 2022: join us and meet the best API experts!

Only one month left until API Platform Conference 2022. Join us and let's see together a sneak peek of the entire schedule!

Join API Platform Conference

Les-Tilleuls.coop

https://api.les-tilleuls.coop/wp-content/uploads/2021/11/vignette-con.png

Accueil

https://secure.gravatar.com/avatar/54fb8ea2a1a36c3b9ef44f25bf976b48?s=96&d=mm&r=g

Cécile Hamerel

SIGNATURE_KEY=XAR5vxusewjY9KJ2w8apxVzVq5EPtl

&lt;?php
declare(strict_types=1);

namespace AppController;

use CoopTilleulsUrlSignerBundleUrlSignerUrlSignerInterface;
use SymfonyBundleFrameworkBundleControllerAbstractController;
use SymfonyComponentHttpFoundationJsonResponse;
use SymfonyComponentHttpFoundationResponse;
use SymfonyComponentRoutingAnnotationRoute;

class VideoController extends AbstractController
{
    public function __construct(
        private UrlSignerInterface $urlSigner,
    )
    {
    }

    #[Route('/videos/{id}/signed-url', methods: ['GET'])]
    public function newSignedUrl(string $id): Response
    {
        $this->denyAccessUnlessGranted('ROLE_USER');
        return new JsonResponse(['url' => $this->generateSignedUrl($id)]);
    }

    private function generateSignedUrl(string $id): string
    {
        $url = $this->generateUrl('download_video', ['id' => $id]);
        // Will expire after 10 seconds.
        $expiration = (new DateTime('now'))->add(new DateInterval('PT10S'));
        return $this->urlSigner->sign($url, $expiration);
    }
}

&lt;?php
declare(strict_types=1);

namespace AppController;

use SymfonyBundleFrameworkBundleControllerAbstractController;
use SymfonyComponentHttpFoundationBinaryFileResponse;
use SymfonyComponentHttpFoundationResponse;
use SymfonyComponentRoutingAnnotationRoute;

class VideoController extends AbstractController
{
    #[Route('/videos/{id}/download', name: 'download_video', defaults: ['_signed' => true], methods: ['GET'])]
    public function download(string $id): Response
    {
        // Get the file.        return new BinaryFileResponse();
    }
}

&lt;?php
declare(strict_types=1);

namespace AppEntity;

use ApiPlatformCoreAnnotationApiResource;
use AppControllerCreateSignedUrlVideoAction;
use AppControllerDownloadVideoAction;

#[ApiResource(
    itemOperations: [
    'get',
    'delete',
    'put',
    'signed_url' => [
        'security' => "is_granted('ROLE_USER')",
        'method' => 'GET',
        'path' => '/videos/{id}/signed-url',
        'controller' => CreateSignedUrlVideoAction::class,
    ],
    'download' => [
        'method' => 'GET',
        'path' => '/videos/{id}/download',
        'controller' => DownloadVideoAction::class,
        'defaults' => ['_signed' => true],
        'formats' => ['binary'],
    ],
],
)]
class Video
{
    // Properties, getters, setters
}

A signed URL is a URL containing authentication information directly in its query string. It allows a non-authenticated user to access protected resources or routes, for a limited time.



Signing a URL can be very useful in a stateless application. There are two main use cases for using them:



<ul><li>allowing an external user to access a resource otherwise not accessible without being authenticated,</li><li>downloading a file with the browser without using Ajax (without a fetch() sending the authentication information).</li></ul>



The latter is the most common use case. Let&rsquo;s take an example: we have created a personal cloud where users can store their files. This application is built with a SPA for the front and communicates with a secured API by using a JWT token. Jean has uploaded a big video showing a live coding session of a nice feature in API Platform, and he wants to download it to watch it again.



The first reflex to implement this download feature in the SPA would be to do something like this:





This method has a lot of drawbacks:



<ul><li>The browser download interface is used only after the file has been downloaded. We need to show Jean that a download is ongoing, for instance by adding a spinner somewhere. Jean cannot pause or cancel the download.</li><li>The downloaded file is stored in memory until it is complete, which can cause performance issues if the file is too big.</li></ul>



To solve this, you could use the JWT token in the query string to download the video. Yes, <a href="https://tools.ietf.org/html/rfc6750#section-2.3" target="_blank" rel="noopener">it is possible</a>, but it is a bad idea:



<ul><li>A JWT token can be big. Big enough to exceed the URL length limit.</li><li>You don&rsquo;t want the JWT tokens to show in your server logs. This is a security breach in your application that would facilitate a <a href="https://en.wikipedia.org/wiki/Session_hijacking">session hijacking</a> kind of attack.</li></ul>



That&rsquo;s why in this case, it is preferable to use a signed URL, like this:





That&rsquo;s way better: fetch() is only used to get the signed URL with authentication, signed URL which is then used directly to download the file. And of course you can also use this signed URL generation for adding a sharing feature, for instance if Jean wants his friends to download the video without being authenticated.



Laravel includes the <a href="https://laravel.com/docs/5.6/urls#signed-urls" target="_blank" rel="noopener">generation of signed URLs</a> since its version 5.6, but there was no easy way to do it in Symfony.



With the <a href="https://github.com/coopTilleuls/UrlSignerBundle" target="_blank" rel="noopener">UrlSignerBundle</a>, it has now been fixed!



So, how do we use it?



<h3>Usage</h3>



First step, install the bundle. By using Symfony Flex, it&rsquo;s very straightforward:





Thanks to Flex, all the configuration has been done (see the config/packages/url_signer.yaml file).



Change the signature in the .env (or the .env.local) file:





Everything is ready to start using the bundle and to create your signed URL!



For instance in a controller, we will inject the UrlSignerInterface service and then use it to create a signed URL which will be returned in the JSON response of the /videos/{id}/signed-url route:





We can now retrieve a signed URL from the /videos/{id}/signed-url route. The signed URL will look like this:



/videos/d35e0296-7b19-42be-82f2-789213229f36/download?expires=1611316656&amp;signature=82f6958bd5c96fda58b7a55ade7f651fadb51e12171d58ed271e744bcc7c85c3



As you can see, the signed URL has two parameters:



<ul><li>expires which contains the timestamp of the expiration date: the URL is no longer valid after this date.</li><li>signature which is in fact the hash of the path, the expiration parameter and the secret.</li></ul>



The last step is to validate it when the route corresponding to the URL is accessed. We reuse our VideoController:





As you can see, we just added a _signed <a href="https://symfony.com/doc/current/routing.html#extra-parameters" target="_blank" rel="noopener">extra parameter</a> to the route. It is this parameter that activates the signature validation when a request hits the route.



And that&rsquo;s it! If you access the download route without a signature or with an invalid signature, you will get a 403 response.



If you want to use signed URLs in API Platform, how do you do it? Well it&rsquo;s even easier!



It will look like this:





The signed_url operation creates the signed URL (and has authentication). The download operation allows users to download the video using the signed URL, with the extra _signed parameter that enables validation of the signed URL. The corresponding controllers are very similar to the previous VideoController controller.



<h3>Features</h3>



There are of course other features in the bundle:



<ul><li>The algorithm to sign the URL can be changed. By default, it is SHA-256.</li><li>You can easily create your own Signer: extend the AbstractUrlSigner class, and you are done (you can use it by modifying the configuration in the config/packages/url_signer.yaml file)!</li><li>The time before expiration is customizable (by default 24h).</li><li>Parameter names in the signed URL are customizable.</li></ul>



<h3>How does it work?</h3>



Internally the bundle uses the library <a href="https://github.com/spatie/url-signer" target="_blank" rel="noopener">spatie/url-signer</a>.



Each Signer corresponds to an algorithm and extends an abstract class (AbstractUrlSigner) based on the Spatie URL signer. In a dedicated compiler pass, the configured signer is automatically aliased to the UrlSignerInterface.



For the validation, the method is really simple: an event listener is used. Each time a request is performed, it checks if the route has the _signed parameter. When it does, the signature is validated by the URL signer.



The bundle is very well tested: it has unit tests with PHPUnit and Prophecy and functional tests with Behat and the SymfonyExtension. The tests cover 100% of the code, and even better, the mutation score, calculated with the mutation testing framework <a href="https://infection.github.io" target="_blank" rel="noopener">Infection</a> is also 100%.



And finally, the type coverage is 100% too, calculated by Psalm (PHPStan is also used).



If you need signed URLs in a Symfony or API Platform project, this bundle is for you! Feel free to test it, tell us what you think about it, and why not contribute to its development on GitHub: <a href="https://github.com/coopTilleuls/UrlSignerBundle" target="_blank" rel="noopener">https://github.com/coopTilleuls/UrlSignerBundle</a>.

UrlSignerBundle, create and validate signed URLs with Symfony

A signed URL is a URL containing authentication information directly in its query string. It allows a non-authenticated user to access protected resources or routes, for a limited time. Signing a URL can be very useful in a stateless application. There are two main use cases for using them: allowing an external user to access [&hellip;]

UrlSignerBundle, create and validate signed URLs with Symfony | Les-Tilleuls.coop

https://api.les-tilleuls.coop/wp-content/uploads/2021/08/419.png

https://secure.gravatar.com/avatar/04b6d9886e782e0676c0d26063f77ac9?s=96&d=mm&r=g

What's new at Les-Tilleuls.coop ?