Laravel 5.6 Signed URL not valid after user submit form - laravel

Question

In my system, using Laravel 5.6, we send a email with a invitation link (using signed URL) where the user click, fill a form and submit it to the server. In this point the user is saved.
The signed URL already contains data like email and perfil_id (like role_id) that will be assigned when the user submits the form.
At which point should I use the $request->hasValidSignature() method?
Because if I wait for the user to fill the form and submit, the method called here will give false to hasValidSignature(). If I validate when passing the view for the user to see the form, the validation will pass but before sending the form the user will be able to tamper with data.
Signed URL inside controller
$url = URL::temporarySignedRoute('completar', now()->addHours(5), [
'email' => $request->get('email'),
'perfil_id' => $request->get('perfil_id'),
'empresa_id' => auth()->user()->empresa_id,
]);
Mail::to($request->get('email'))->send(new UserRegistrationInvite($url));
Form inside the view that user has to fill after using the link on email
<form action="{{route("aceitar")}}" method="post">
<input type="hidden" name="email" value="{{$request['email']}}">
<input type="hidden" name="perfil_id" value="{{$request['perfil_id']}}">
<input type="hidden" name="empresa_id" value="{{$request['empresa_id']}}">
<input type="hidden" name="signature" value="{{$request['signature']}}">
<br>
<label for="name">Digite seu nome: </label>
<input type="text" id="Nome" name="name" placeholder="Nome">
<br>
<label for="password">Digite sua senha: </label>
<input type="password" name="password" id="password">
<br>
<label for="password_confirmation">confirme sua senha: </label>
<input type="password" name="password_confirmation" id="password_confirmation">
<hr>
<button type="submit" id="convite">Enviar</button>
</form>
function called when user submits form. here validation will fail
public function aceitar(Request $request) {
// verifica se a signed URL é válida
if (!$request->hasValidSignature()) {
abort(response()->json('URL não válida - aceitar', 403));
}
// ao submeter o formulario anterior, faz validação
$validator = Validator::make($request->all(), [
'name' => 'required',
'perfil_id' => 'required',
'empresa_id' => 'required',
'email' => 'required|email',
'password' => 'required|confirmed'
]);
// se validação falhar exibe erros na tela
if ($validator->fails()) {
return $validator->errors();
} else {
// se passar na validação usuário é criado com perfil e permissões ja relacionadas
$usuario = User::create([
'email' => $request->email,
'name' => $request->name,
'password' => bcrypt($request->password),
'empresa_id' => $request->empresa_id,
]);
$usuario->perfil()->attach($request->perfil_id);
return 'Usuário criado com sucesso';
}
thanks for your time.

Answer 1

The signature is only valid on the first URL that the user visits: 'completar'.
When they post the form, the same signature is no longer valid on the 'aceitar' route.
You can verify the signature before even showing them the form and consider it trusted.
You can also generate another temporary signed URL for the post route in the form if you want to add another validation step.