Using signed routes with InitializeTenancyByRequestData results in invalid signature

[secrethash]

Bug description

When creating a signed route (in my case absolute is false) for central domain and using signed:relative & InitializeTenancyByRequestData::class middleware together it returns 403 Invalid signature error.

Steps to reproduce

• Create a signed route URL

  use Illuminate\Support\Uri;
  
  ...
  
  $portal = Uri::temporarySignedRoute(
    'test.home',
    now()->addSeconds(30),
    absolute: false
  )->withQuery([
    'tenant' => $tenant->id,
    'access_token' => Auth::getTokenForRequest(),
  ])->withHost(config('test.domain'))
    ->withScheme(config('app.force_secure') ? 'https' : 'http');

• Make sure the central domain is present in config/tenancy.php
• Add middleware to route, here test.home

  Route::prefix('portal')
    ->name('test.')
    ->middleware([
      'signed:relative',
      InitializeTenancyByRequestData::class,
      'auth:api'
    ])->group(function () {
      Route::get('/', [TestController::class, 'index'])->name('home');
    });

Expected behavior

The signature should be valid

Laravel version

12.19.3

stancl/tenancy version

dev-master:e1fc0e107d236a113ab5e67fc1fa0044925100e4

[secrethash]

So for me it also doesn't work with path identification InitializeTenancyByPath::class for some reason.

I even tried dividing into two separate nested groups but since we are making tenancy middleware high priority in service provider, they always load first.

Route::prefix('portal')
  ->name('test.')
  ->middleware(['signed:relative'])
  ->group(function () {
    Route::prefix('{tenant}')
      ->middleware([Middleware\InitializeTenancyByPath::class])
      ->group(function () {
        Route::get('/', [TestController::class, 'index'])->name('home');
      });
  });

[stancl]

Hmm I'll take a look at this. If you can provide any more stripped down reproductions that'll help.

In general signed URLs are only difficult with tenancy when you use absolute URLs so e.g. the UrlGeneratorBootstrapper addresses how such URLs are generated. And it's specifically the route generation that's problematic not the routes themselves.

[secrethash]

@stancl I was able to fix the issue. Apparently, I had to pass the data as parameters rather than appending the query string. Since the signature is calculated using the query string as well so the generated and validated signatures were not an equal hash. The parameter converts it as a query string if named param is not present (here access_token) for the route and also includes it for signature calculation.

For reference:

/* BEFORE */
$portal = Uri::temporarySignedRoute(
  'test.home',
  now()->addSeconds(30),
  absolute: false
)->withQuery([ // <-- These would go in as parameters rather than query
  'tenant' => $tenant->id,
  'access_token' => Auth::getTokenForRequest(),
])->withHost(config('test.domain'))
  ->withScheme(config('app.force_secure') ? 'https' : 'http');

/* AFTER */
$portal = Uri::temporarySignedRoute(
  'test.home',
  now()->addSeconds(30),
  parameters: [
    'tenant' => $tenant->id,
    'access_token' => Auth::getTokenForRequest(),
  ]
  absolute: false
)->withHost(config('test.domain'))
  ->withScheme(config('app.force_secure') ? 'https' : 'http');

Still don't know why it was working somehow in a non-tenant context.