Eloquent Encrypted Casting

Published on by

Eloquent Encrypted Casting image

A recent pull request by Jason McCreary which was released in Laravel 8.12 included the ability to encrypt a model attribute using an Eloquent cast.
The included encrypted cast option now also allows casting the attribute into an array, JSON, object or a collection after it has been decrypted.

class EncryptedCast extends Model
{
public $casts = [
'secret' => 'encrypted',
'secret_array' => 'encrypted:array',
'secret_json' => 'encrypted:json',
'secret_object' => 'encrypted:object',
'secret_collection' => 'encrypted:collection',
];
...
}

This encrypted cast uses Laravel’s Crypt facade to encrypt and decrypt the attribute from the database. There were earlier PRs back in Laravel 5.3 which were closed that attempted to bring this functionality into Laravel.
If you use Laravel’s built-in encrypted cast notation then it is important to realise this locks your app key. As this is the secret which Crypt uses under the hood to encrypt and decrypt everything in Laravel from sessions and cookies.

The same weekend that Laravel encrypted casts were added into Laravel core, I completed a hackathon hosted by my Employer UKFast where I created EloquentEncrypted. This uses 4096-bit RSA keys to cast model attributes into the database in an encrypted form.

This separates Eloquents encryption from the app key so that you are free to rotate this as needed, something that is advised by Tighten in their blog post APP_KEY And You. This package also includes migration helpers to set the encrypted field accordingly in your database.

Schema::create('sales_notes', function (Blueprint $table) {
$table->increments('id');
$table->encrypted('private_data');
$table->timestamps();
});

The Eloquent Encryption package also allows for casting after encryption with a couple of initial offers to show how this can be done. You can cast to a string using the default Encrypted cast, an Integer or float and even to a collection. Collections are serialised into JSON strings which are then encrypted.

<?php
 
namespace App\Models;
 
use Illuminate\Database\Eloquent\Model;
use RichardStyles\EloquentEncryption\Casts\Encrypted;
use RichardStyles\EloquentEncryption\Casts\EncryptedInteger;
use RichardStyles\EloquentEncryption\Casts\EncryptedFloat;
use RichardStyles\EloquentEncryption\Casts\EncryptedCollection;
 
class SalesData extends Model
{
/**
* The attributes that should be cast.
*
* @var array
*/
protected $casts = [
'private_data' => Encrypted::class,
'private_int' => EncryptedInteger::class,
'private_float' => EncryptedFloat::class,
'private_collection' => EncryptedCollection::class,
];
}

I’ve also put together another package called Eloquent AES which allows you to use AES-256-CBC encryption for your eloquent model data. This creates a separate Eloquent key which is used to encrypt/decrypt during casting.

<?php
namespace App\Models;
 
use Illuminate\Database\Eloquent\Model;
use RichardStyles\EloquentAES\Casts\AESEncrypted;
 
class SalesData extends Model
{
/**
* The attributes that should be cast.
*
* @var array
*/
protected $casts = [
'private_data' => AESEncrypted::class,
];
}

This simply creates another instance of the Encrypter class within laravel using a different config key. This second package was created because people should be able to choose the method of encryption and how that choice affects other areas of their applications.

Richard Styles photo

Senior PHP Developer, with full-stack experience. TailwindCSS advocate.

Filed in:
Cube

Laravel Newsletter

Join 40k+ other developers and never miss out on new tips, tutorials, and more.

image
Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Visit Laravel Forge
Laravel Forge logo

Laravel Forge

Easily create and manage your servers and deploy your Laravel applications in seconds.

Laravel Forge
Tinkerwell logo

Tinkerwell

The must-have code runner for Laravel developers. Tinker with AI, autocompletion and instant feedback on local and production environments.

Tinkerwell
No Compromises logo

No Compromises

Joel and Aaron, the two seasoned devs from the No Compromises podcast, are now available to hire for your Laravel project. ⬧ Flat rate of $7500/mo. ⬧ No lengthy sales process. ⬧ No contracts. ⬧ 100% money back guarantee.

No Compromises
Kirschbaum logo

Kirschbaum

Providing innovation and stability to ensure your web application succeeds.

Kirschbaum
Shift logo

Shift

Running an old Laravel version? Instant, automated Laravel upgrades and code modernization to keep your applications fresh.

Shift
Bacancy logo

Bacancy

Supercharge your project with a seasoned Laravel developer with 4-6 years of experience for just $2500/month. Get 160 hours of dedicated expertise & a risk-free 15-day trial. Schedule a call now!

Bacancy
Lucky Media logo

Lucky Media

Bespoke software solutions built for your business. We ♥ Laravel

Lucky Media
Lunar: Laravel E-Commerce logo

Lunar: Laravel E-Commerce

E-Commerce for Laravel. An open-source package that brings the power of modern headless e-commerce functionality to Laravel.

Lunar: Laravel E-Commerce
LaraJobs logo

LaraJobs

The official Laravel job board

LaraJobs
Larafast: Laravel SaaS Starter Kit logo

Larafast: Laravel SaaS Starter Kit

Larafast is a Laravel SaaS Starter Kit with ready-to-go features for Payments, Auth, Admin, Blog, SEO, and beautiful themes. Available with Vue and Livewire stacks.

Larafast: Laravel SaaS Starter Kit
SaaSykit: Laravel SaaS Starter Kit logo

SaaSykit: Laravel SaaS Starter Kit

SaaSykit is a Laravel SaaS Starter Kit that comes with all features required to run a modern SaaS. Payments, Beautiful Checkout, Admin Panel, User dashboard, Auth, Ready Components, Stats, Blog, Docs and more.

SaaSykit: Laravel SaaS Starter Kit
Rector logo

Rector

Your partner for seamless Laravel upgrades, cutting costs, and accelerating innovation for successful companies

Rector

The latest

View all →
Running a Single Test, Skipping Tests, and Other Tips and Tricks image

Running a Single Test, Skipping Tests, and Other Tips and Tricks

Read article
View Third-party Relations in model:show - Now Available in Laravel 11.11 image

View Third-party Relations in model:show - Now Available in Laravel 11.11

Read article
Asserting a JSON Response Structure in Laravel image

Asserting a JSON Response Structure in Laravel

Read article
Backpack turns 8 years old, celebrates with 40% discount image

Backpack turns 8 years old, celebrates with 40% discount

Read article
Create a DateTime from a Timestamp With this New Method Coming to PHP 8.4 image

Create a DateTime from a Timestamp With this New Method Coming to PHP 8.4

Read article
Neovim Plugin to for Navigating Laravel and Livewire Components image

Neovim Plugin to for Navigating Laravel and Livewire Components

Read article