1

Basically I want to secure the database connection and other AWS information. Below is the sample file for laravel .env

APP_NAME=Laravel
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=laravel
DB_USERNAME=root
DB_PASSWORD=

MAIL_MAILER=smtp
MAIL_HOST=smtp.mailtrap.io
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=null
MAIL_FROM_NAME="${APP_NAME}"
7
  • 1
    Why/what for? .env files are usually not available via your webserver/publicly viewable
    – brombeer
    Jun 7, 2020 at 12:16
  • Yes, I know. We can set the permissions to the file. But for the double security Is there any way I can encrypt the database connection? Jun 7, 2020 at 12:18
  • 2
    But you use the app key for encryption decryption, so it will not be safe anyways if the got the env file?
    – mrhn
    Jun 7, 2020 at 12:34
  • 2
    Technically it is possible, but you will cause yourself a lot of pain as every variable that is encrypted will have to be decrypted before it can be used, which would mean manually encrypting all variables in the .env file as well as decrypting in all configs they are used in. If the setup is good no one can see or do anything with this file. its not just about setting up the permissions for the file, in a good installation the .env file is above the public directory and therefore cannot be accessed at all. The standard entry point should be the public folder, not root.
    – ColinMD
    Jun 7, 2020 at 12:37
  • Someone recently asked what happens if the .env file gets compromised (spoiler: it's bad) and since the APP_KEY used to encrypt and decrypt data is save there too I would say it's not worth the hassle.
    – Dan
    Jun 7, 2020 at 12:39

2 Answers 2

5

It is possible now from Laravel 9.32 onward. https://github.com/laravel/framework/pull/44034#issue-1364610312

Running php artisan env:encrypt will look for a .env file at the root of the project, grab the contents of the file, encrypt it with a new key and save it as .env.encrypted. The decryption key is displayed in the output of the command along with the cipher used and the path of the encrypted file.

The env:decrypt command decrypts the contents of the encrypted environment file and writes the output to the .env of the chosen environment. A decryption key is required to run this command. php artisan env:decrypt --key=h9kAPUmxdZ8ZbwT3

More options to encrypt and decrypt are mentioned in the issue link provided above.

0

Option 1. Use something like this (GitHub Laravel Encryptenv).

Your mileage may vary, as it's not exactly easy to maintain and setup.

Option 2. Cook a variation of the above (but a lot more simple). In your config/database.php file:

use Illuminate\Encryption\Encrypter;
$key = getenv('SECRETKEY');
$encrypter = new Encrypter($key, 'aes-128-cbc');

//...

'mysql' => [
//...
'password' => $encrypter->decrypt(env('DB_PASSWORD', '')),

Obviously, SECRETKEY is an environment variable holding the decryption key.

You may ask "Where would I get the decryption key SECRETKEY from?"

One option is to inject it via your web server, for example in your nginx config, within sites-enabled/001-yoursite.conf configuration:

location ~ \.php$ {
           set $script_filename $document_root$fastcgi_script_name;
           set $configkey "";
           if ($script_filename = "/var/www/yoursitepath/html/public/index.php") {
                 set $configkey "AAAAAAAAAAAAAAAA";
           }

           fastcgi_param SCRIPT_FILENAME $script_filename;
           fastcgi_param CONFIGKEY $configkey;

where "AAAAAAAAAAAAAAAAA" is your AES-128-CBC key (has to be 16 characters). Feel free to switch to AES-256-CBC, if you want a larger key (and a bit more questionable security).

The above provides the key only to your Laravel index.php file. The reason for this restriction is that anyone that can create a PHP file in your webroot would be able to just print the value of the key, so your entire house of cards will collapse.

For the above to have any meaningful protection:

  1. You must restrict the nginx config file 001-yoursite.conf to be readable only by root.
  2. You must disable anyone from modifying index.php (chmod 440 index.php). If you allow regular system users to modify your index.php, they would be able to trivially print out your "secret key".

The above "encryption" protects only against stuff like shoulder-surfing attacks, and is by no means a replacement for proper security measures, such as careful configuration of your webroot, hardening, etc.

The above mainly works for scenarios where you need to make compliance beancounters happy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.