Laravel 5.8验证邮件用户ID混淆加密及后端验证实现步骤咨询

1. 利用Laravel自带加密工具处理用户ID #

Laravel 5.8内置的Crypt类可直接用于加解密操作，无需额外依赖。加密用户ID使用Crypt::encrypt($userId)，解密则用Crypt::decrypt($encryptedId)，注意必须捕获解密失败的异常，避免恶意请求导致报错。

2. 修改验证邮件的链接生成逻辑 #

找到发送邮箱验证通知的代码，通常在User模型或对应的通知类中修改：

方式一：直接在User模型中重写发送逻辑 #

use Illuminate\Support\Facades\Crypt;
use Illuminate\Auth\Notifications\VerifyEmail;

public function sendEmailVerificationNotification()
{
    $this->notify(new class extends VerifyEmail {
        protected function verificationUrl($notifiable)
        {
            // 加密用户ID
            $encryptedId = Crypt::encrypt($notifiable->getKey());
            
            // 构建验证链接，替换原ID为加密后的内容
            return url(route('verification.verify', [
                'id' => $encryptedId,
                'hash' => sha1($notifiable->getEmailForVerification()),
                'expires' => now()->addMinutes(60)->getTimestamp(),
                'signature' => hash_hmac('sha256', sprintf(
                    '%s|%s|%s',
                    $notifiable->getKey(),
                    $notifiable->getEmailForVerification(),
                    now()->addMinutes(60)->getTimestamp()
                ), config('app.key'))
            ], false));
        }
    });
}

方式二：自定义验证通知类 #

先创建自定义通知文件app/Notifications/CustomVerifyEmail.php：

namespace App\Notifications;

use Illuminate\Auth\Notifications\VerifyEmail as VerifyEmailBase;
use Illuminate\Support\Facades\Crypt;

class CustomVerifyEmail extends VerifyEmailBase
{
    protected function verificationUrl($notifiable)
    {
        $encryptedId = Crypt::encrypt($notifiable->getKey());
        
        return url(route('verification.verify', [
            'id' => $encryptedId,
            'hash' => sha1($notifiable->getEmailForVerification()),
            'expires' => now()->addMinutes(60)->getTimestamp(),
            'signature' => hash_hmac('sha256', sprintf(
                '%s|%s|%s',
                $notifiable->getKey(),
                $notifiable->getEmailForVerification(),
                now()->addMinutes(60)->getTimestamp()
            ), config('app.key'))
        ], false));
    }
}

再在User模型中调用该自定义通知：

use App\Notifications\CustomVerifyEmail;

public function sendEmailVerificationNotification()
{
    $this->notify(new CustomVerifyEmail);
}

3. 修改验证控制器的逻辑 #

找到app/Http/Controllers/Auth/VerificationController.php，修改verify方法，先解密ID再执行验证：

use Illuminate\Support\Facades\Crypt;
use Illuminate\Contracts\Encryption\DecryptException;
use Illuminate\Auth\Access\AuthorizationException;

public function verify(Request $request)
{
    try {
        // 解密用户ID
        $userId = Crypt::decrypt($request->route('id'));
        $user = \App\User::findOrFail($userId);
    } catch (DecryptException $e) {
        // 解密失败，返回错误页面
        return redirect('/home')->with('error', '验证链接无效');
    }

    // 验证邮箱哈希是否匹配
    if (! hash_equals((string) $request->route('hash'), sha1($user->getEmailForVerification()))) {
        throw new AuthorizationException;
    }

    // 验证过期时间（保留原逻辑）
    if ($request->route('expires') < now()->getTimestamp()) {
        return redirect('/home')->with('error', '验证链接已过期');
    }

    // 验证签名（注意仍使用原始用户ID生成校验）
    if (! hash_equals((string) $request->route('signature'), hash_hmac('sha256', sprintf(
        '%s|%s|%s',
        $user->getKey(),
        $user->getEmailForVerification(),
        $request->route('expires')
    ), config('app.key')))) {
        throw new AuthorizationException;
    }

    // 标记邮箱为已验证
    if (! $user->hasVerifiedEmail()) {
        $user->markEmailAsVerified();
    }

    return redirect('/home')->with('success', '邮箱验证成功');
}

4. 关键注意事项 #

• 确保.env中的APP_KEY配置正确且不泄露，这是加解密的核心密钥。
• 签名生成必须使用原始用户ID，不能用加密后的ID，否则签名校验会失败。
• 解密时必须捕获DecryptException，防止恶意构造的无效加密串抛出致命错误。

内容的提问来源于stack exchange，提问作者Neokyuubi