Database Encryption in Laravel: How to Encrypt a Database Connection String in Laravel?

Database security is an essential aspect of any web application development. Laravel, a popular PHP framework, provides several built-in features to ensure the security of your application's data. One of these features is the ability to encrypt sensitive data, including database connection strings. In this answer, we will discuss how to encrypt a database connection string in Laravel.

Before we begin, it's important to note that Laravel provides two ways to encrypt data: using the encrypt() function or using the key.php file. In the context of database connection strings, we will use the key.php file method, as it provides a more secure and convenient way to manage encryption keys.

Here are the steps to encrypt a database connection string in Laravel:

Generate a new encryption key

The first step is to generate a new encryption key. This key will be used to encrypt and decrypt sensitive data, including the database connection string. To generate a new key, run the following command in your terminal:

php artisan key:generate

This command will generate a new encryption key and save it in the key.php file located in the .env directory.

Edit the .env file

Next, open the .env file located in the root directory of your Laravel application and add the following variables to encrypt your database connection string:

DB_DATABASE=your_database_name
DB_USERNAME=your_database_username
DB_PASSWORD=your_database_password
DB_PORT=your_database_port
DB_HOST=your_database_host

DB_ENCRYPTED=1
DB_DATABASE_ENCRYPTED=your_encrypted_database_name
DB_USERNAME_ENCRYPTED=your_encrypted_database_username
DB_PASSWORD_ENCRYPTED=your_encrypted_database_password

Replace your_database_name, your_database_username, your_database_password, your_database_port, and your_database_host with your actual database credentials.

The DB_ENCRYPTED variable is set to 1 to indicate that the following variables will be encrypted.

Encrypt the database connection string

Now, you need to encrypt the DB_DATABASE, DB_USERNAME, and DB_PASSWORD variables using the encrypt() function. To do this, open the .env file and replace the unencrypted variables with their encrypted counterparts:

DB_DATABASE=encrypted:your_encrypted_database_name
DB_USERNAME=encrypted:your_encrypted_database_username
DB_PASSWORD=encrypted:your_encrypted_database_password

DB_ENCRYPTED=1
DB_DATABASE_ENCRYPTED=your_encrypted_database_name
DB_USERNAME_ENCRYPTED=your_encrypted_database_username
DB_PASSWORD_ENCRYPTED=your_encrypted_database_password

Next, run the following command to encrypt the variables:

php artisan config:cache

This command will cache the configuration file, which includes the encrypted variables.

Decrypt the database connection string

To decrypt the database connection string, Laravel provides a helper function called app(). This function can be used to access the encrypted variables and decrypt them using the encryption key.

Here's an example of how to decrypt the database connection string in your .env file:

DB_DATABASE=database
DB_USERNAME=username
DB_PASSWORD=password

DB_DATABASE_ENCRYPTED=encrypted:your_encrypted_database_name
DB_USERNAME_ENCRYPTED=encrypted:your_encrypted_database_username
DB_PASSWORD_ENCRYPTED=encrypted:your_encrypted_database_password

DB_ENCRYPTED=1

// In your Laravel service provider or bootstrap file
function decryptDatabaseCredentials() {
    $keyPath = base_path('.env');

    $key = file_get_contents($keyPath);

    $decrypted = [
        'database' => env('DB_DATABASE_ENCRYPTED', ''),
        'username' => env('DB_USERNAME_ENCRYPTED', ''),
        'password' => env('DB_PASSWORD_ENCRYPTED', ''),
    ];

    $decrypted = array_map(function ($value) use ($key) {
        return app('crypto')->decryptString($value, $key);
    }, $decrypted);

    return $decrypted;
}

// Use the decrypted credentials in your Laravel configuration file
$credentials = decryptDatabaseCredentials();

return [
    'default' => [
        'driver' => 'mysql',
        'url' => env('DATABASE_URL', ''),

        'database' => $credentials['database'],
        'username' => $credentials['username'],
        'password' => $credentials['password'],

        // Other configuration options...
    ],
];

In this example, we define a decryptDatabaseCredentials() function that decrypts the encrypted database credentials using the encryption key. We then use this function to decrypt the credentials and return them in an array. Finally, we use the decrypted credentials to configure the Laravel database connection.

That's it! You have now encrypted your database connection string in Laravel using the key.php file method. This will help ensure the security of your application's data by keeping your database credentials hidden from unauthorized users.