Search code examples
phplaravelsecurityencryptionsession-cookies

How can I change default cookie encryption to more secured encryption in laravel?


I am new to laravel development I want to change default base_64 cookie encryption to a more secured AES-256-CBC or any other more secured encryption.


Solution

  • Laravel encrypts and decrypts all cookies by default and it uses OpenSSL using AES-256 and AES-128 encryption to achieve this. Base64 is not an encryption method anyway, it is only a encoding scheme. Anyone can encode any data to base64 and decode it back; it's not encryption. Encryption needs a method and a secure key (or key pair). So; if you don't have the right key and know the right method you can't decrypt an encrypted data. For encoded data it's not a thing, anyone can decode base64 encoded string. Encryption is for secure storing and transporting and on the other hand encoding is just for making any data to be storable and transportable in text format.

    Laravel makes sure every different Laravel application uses different encryption keys by using APP_KEY env value.

    Check Laravel Cookies & Encryption: https://laravel.com/docs/8.x/responses#cookies-and-encryption

    By default, all cookies generated by Laravel are encrypted and signed so that they can't be modified or read by the client.

    Also check Laravel Encryption: https://laravel.com/docs/8.x/encryption

    Laravel's encryption services provide a simple, convenient interface for encrypting and decrypting text via OpenSSL using AES-256 and AES-128 encryption. All of Laravel's encrypted values are signed using a message authentication code (MAC) so that their underlying value can not be modified or tampered with once encrypted.

    So, you are safe with Laravel Encryption and already using AES-256 and AES-128 encryption.