javascript - JS Decrypt Laravel Encrypted String

Solution:

Like @Dusan Malusev already mentioned:

You should not use Laravel APP_KEY in frontend code. NEVER, Laravel uses APP_KEY to encrypt everything including cookies (Session cookie and csrf cookie).

Your application could be hacked if it's in your html code! To answer your question a bit: useCrypt::decrypt($encrypted) on the server side of your application (within Laravel).

Solution:

Never use your Laravel APP_KEY in frontend. It is a big software vulnerability.

You should create a trait that encrypts and decrypts data before setting and getting data.

To use Laravel Crypt add Encryptable.php

<?PHP
namespace App;

use Illuminate\Support\Facades\Crypt;

trait Encryptable
{
    public function getAttribute($key)
    {
        $value = parent::getAttribute($key);

        if (in_array($key, $this->encryptable)) {
            $value = Crypt::decrypt($value);
        }
        return $value;
    }

    public function setAttribute($key, $value)
    {
        if (in_array($key, $this->encryptable)) {
            $value = Crypt::encrypt($value);
        }

        return parent::setAttribute($key, $value);
    }
}
Copy code

After that you can use this trait in your models. Add a $encryptable property. Array of columns to be encrypted and decrypted.

class User extends Model
{    
    use Encryptable;
    
    protected $encryptable = [
       'column',
       'anotherColumn',
    ];
}
Copy code

After that use model as you use before.

Solution:

I have used in ReactJs

CryptoJS 4.1

let key = process.env.REACT_APP_ENCRYTO_KEY

            let encrypted = atob(response.data)
            encrypted = JSON.parse(encrypted)
            const iv = CryptoJS.enc.Base64.parse(encrypted.iv)
            const value = encrypted.value
            key = CryptoJS.enc.Base64.parse(key)
            let decrypted = CryptoJS.AES.decrypt(value, key, {
                iv
            })
            decrypted = decrypted.toString(CryptoJS.enc.Utf8)
            return {
                ...response,
                data: JSON.parse(decrypted)
            }
Copy code

Laravel 8.x usingEncrypter

$encrypter = new Encrypter(Encrypter::generateKey('supported_any_cipher'));
return response($encrypter->encryptString(json_encode($response)), 200);
Copy code

The supported cipher algorithms and their properties.

['aes-128-cbc' => ['size' => 16, 'aead' => false],
'aes-256-cbc' => ['size' => 32, 'aead' => false],
'aes-128-gcm' => ['size' => 16, 'aead' => true],
'aes-256-gcm' => ['size' => 32, 'aead' => true]]
Copy code