Download the PHP package psecio/secure_dotenv without Composer
On this page you can find all versions of the php package psecio/secure_dotenv. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download psecio/secure_dotenv
More information about psecio/secure_dotenv
Files in psecio/secure_dotenv
Package secure_dotenv
Short Description An encrypted environment configuration handler
License MIT
Homepage https://github.com/psecio/secure_dotenv.git
Informations about the package secure_dotenv
secure_dotenv
The secure_dotenv
library provides an easy way to handle the encryption and decryption of the information in your .env
file.
One of the generally accepted security best practices is preventing the use of hard-coded, plain-text credentials of any kind. This library allows you to store the values in your .env
as encrypted strings but still be able to access them transparently without worrying about implementing your own encryption method.
Installation
Download Composer package
You can install the library easily with a Composer require
call on the command line:
Generate the key
First, you'll need to generate your encryption key. The library makes use of the defuse/php-encryption library for it's encryption handling.
This will result in a randomized string to use with the php-encryption
library's default encryption. This string should be placed in a file where the script can access it.
NOT: According to security best practices, this key file should remain outside of the document root (not web accessible) but should be readable by the web server user (or executing user).
Create the .env
file
You'll then need to make the .env
file you're wanting to place the values in:
Loading the values
With the key file and .env created, you can now create a new instance that can be used to read the encrypted values:
You don't have to use a file as a source for the key either - you can use a string (potentially something fron an $_ENV
variable or some other source):
This can be useful to help prevent the key from being read by a local file inclusion attack.
If there are values currently in your .env
file that are unencrypted, the library will pass them over and just return the plain-text version as pulled directly from the .env
configuration.
Setting values
You can also dynamically set values into your .env
file using the save()
method on the Parser
class:
There's no need to worry about encrypting the value as the library takes care of that for you and outputs the encrypted result to the .env
file.
Encrypting values via CLI
This library also comes with a handy way to encrypt values and write them out to the .env
configuration automatically:
This tool will ask a few questions about the location of the .env
file and the key/value pair to set. When it completes it will write the new, encrypted, value to the .env
file. If a value is already set in the configuration and you want to overwrite it, call the encrypt
script with the --override
command line flag.
All versions of secure_dotenv with dependencies
defuse/php-encryption Version ^2.2
enygma/cmd Version ^0.4.0
league/climate Version ^3.4