People searching “Laravel signed URL email” build the link in Vue and hope the email client keeps it. Build it in PHP. The Fortify guide already does this for password reset. A custom mail uses the same middleware.
TL;DR
- temporarySignedRoute belongs in the mail.
- The Vue page opens after the signed middleware passes.
- Do not sign the URL for a year.
- Do not log the full URL.
The fix#
$url = URL::temporarySignedRoute(
'posts.review',
now()->addDays(3),
['post' => $post->id],
);Mail that string. The route is:
Route::get('/posts/{post}/review', [PostController::class, 'review'])
->middleware('signed')
->name('posts.review');An edited query string fails the signature and Laravel returns 403. The controller can render an Inertia page after that. The link in the email is a normal <a href>. It is not an Inertia <Link>, because a mail client is not your app.
What to avoid#
Gotcha
Do not sign the URL for a year. Three days is a decision you can defend. Do not log the full URL. It is the credential.
FAQ#
How do I put a signed URL in an email?
temporarySignedRoute belongs in the mail. The Vue page opens after the signed middleware passes.
What goes wrong with Laravel signed URL email?
Many developers build the link in Vue and hope the email client keeps it. Do not sign the URL for a year.
