Download the PHP package hejunjie/encrypted-request without Composer
On this page you can find all versions of the php package hejunjie/encrypted-request. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download hejunjie/encrypted-request
More information about hejunjie/encrypted-request
Files in hejunjie/encrypted-request
Package encrypted-request
Short Description PHP 请求加密工具包，支持 AES 解密、签名与时间戳验证，快速实现前后端安全通信 | PHP encryption toolkit for AES decryption, signature, and timestamp verification, enabling fast and secure front-to-backend communication. Front-end npm package generates encrypted request parameters without changing existing APIs
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package encrypted-request
hejunjie/encrypted-request
English ｜ 简体中文
A PHP encryption toolkit for secure front-end to back-end communication.
In real-world development, API endpoints often require security: data needs encryption to prevent sniffing, and requests must be protected from tampering and replay attacks. Coordinating encryption methods and signature rules with the front-end can be tedious. This package, paired with the front-end npm package, lets the front-end generate encrypted request parameters with a single call, while the back-end decrypts and verifies in just a few lines of code.
Front-end companion npm package: npm-encrypted-request
This project has been parsed by Zread. Click to learn more: Learn More
Features
- 🔐 Hybrid encryption: AES-256-GCM symmetric encryption + RSA-OAEP asymmetric encryption. AES keys are randomly generated by the front-end and transmitted via RSA public key encryption — the back-end only needs the RSA private key
- ✍️ HMAC-SHA256 signature verification: Prevents request parameters from being tampered with
- ⏰ Timestamp validation: Second-level verification with configurable tolerance to prevent request replay
- 🔑 Nonce anti-replay: One-time random number mechanism to block duplicate requests
- ⚙️ Flexible configuration: Supports
.envfiles, inline arrays, or custom.envpaths - 🧩 Extensible: Pluggable Nonce validator (Redis, APCu, etc.) for production environments
Installation
Quick Start
1. Configuration
Via .env file:
Or via an array:
2. Decrypt Requests
[!WARNING] Without the third argument, the default
InMemoryNonceValidatorstores nonces in process memory, which is lost after each PHP request — it cannot truly prevent replay attacks. Always pass a custom Nonce validator in production. See the "Custom Nonce Validator" section below.
Configuration Reference
| Config | Type | Required | Default | Description |
|---|---|---|---|---|
RSA_PRIVATE_KEY |
string | ✅ | - | RSA private key for decrypting the AES key from the front-end |
SIGN_SECRET |
string | ✅ | - | HMAC-SHA256 signing key, must match the front-end |
DEFAULT_TIMESTAMP_DIFF |
int | ❌ | 60 |
Timestamp tolerance in seconds |
NONCE_TTL |
int | ❌ | 300 |
Nonce time-to-live in seconds |
How It Works
- Signature verification (runs first): HMAC-SHA256 over
en_data + enc_payload + timestampusingSIGN_SECRET. Invalid requests are rejected immediately. - Timestamp check: Ensures the request timestamp is within the configured tolerance.
- RSA decryption: Decrypts
enc_payloadwith the RSA private key to obtain the AES key, IV, and Nonce. - Nonce verification: Checks whether the Nonce has been used before, preventing replay attacks.
- AES-256-GCM decryption: Decrypts the request data using the extracted AES key and IV.
Front-End Integration
The front-end uses the hejunjie-encrypted-request npm package to generate encrypted data:
The PHP back-end can then decrypt directly using EncryptedRequestHandler.
Custom Nonce Validator
The default InMemoryNonceValidator stores nonces in process memory and is only suitable for single-process or testing environments. For production, implement the NonceValidatorInterface (e.g., with Redis, APCu, or a database) and pass it as the third argument to the EncryptedRequestHandler constructor:
Directory Structure
Compatibility
- PHP >= 8.0
- Requires PHP OpenSSL extension
- Works with any PSR-4 autoloading framework or vanilla PHP project
FAQ
Is the default Nonce validator suitable for production?
No. InMemoryNonceValidator stores data in process memory, which is lost after each PHP request — it cannot reliably prevent replay attacks. For production, inject a Redis or database-backed implementation as shown in the "Custom Nonce Validator" section above.
How do I keep the signing key consistent between front-end and back-end?
The SIGN_SECRET value must exactly match the signSecret parameter passed to encryptRequest() on the front-end. Store the key in .env and sync it to the front-end through a secure channel.
Which PHP frameworks are supported?
Any project following PSR-4 autoloading, including but not limited to Laravel, Symfony, Slim, ThinkPHP, and plain PHP projects.
Contributing
Issues and pull requests are welcome.
