A recent pull request by Jason McCreary which was released in Laravel 8.12 included the ability to encrypt a model attribute using an Eloquent cast.
The included encrypted cast option now also allows casting the attribute into an array, JSON, object or a collection after it has been decrypted.

class EncryptedCast extends Model
{
    public $casts = [
        'secret' => 'encrypted',
        'secret_array' => 'encrypted:array',
        'secret_json' => 'encrypted:json',
        'secret_object' => 'encrypted:object',
        'secret_collection' => 'encrypted:collection',
    ];
    ...
}

This encrypted cast uses Laravel’s Crypt facade to encrypt and decrypt the attribute from the database. There were earlier PRs back in Laravel 5.3 which were closed that attempted to bring this functionality into Laravel.
If you use Laravel’s built-in encrypted cast notation then it is important to realise this locks your app key. As this is the secret which Crypt uses under the hood to encrypt and decrypt everything in Laravel from sessions and cookies.

The same weekend that Laravel encrypted casts were added into Laravel core, I completed a hackathon hosted by my Employer UKFast where I created EloquentEncrypted. This uses 4096-bit RSA keys to cast model attributes into the database in an encrypted form.

This separates Eloquents encryption from the app key so that you are free to rotate this as needed, something that is advised by Tighten in their blog post APP_KEY And You. This package also includes migration helpers to set the encrypted field accordingly in your database.

Schema::create('sales_notes', function (Blueprint $table) {
    $table->increments('id');
    $table->encrypted('private_data');
    $table->timestamps();
});

The Eloquent Encryption package also allows for casting after encryption with a couple of initial offers to show how this can be done. You can cast to a string using the default Encrypted cast, an Integer or float and even to a collection. Collections are serialised into JSON strings which are then encrypted.

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use RichardStyles\EloquentEncryption\Casts\Encrypted;
use RichardStyles\EloquentEncryption\Casts\EncryptedInteger;
use RichardStyles\EloquentEncryption\Casts\EncryptedFloat;
use RichardStyles\EloquentEncryption\Casts\EncryptedCollection;

class SalesData extends Model
{
    /**
     * The attributes that should be cast.
     *
     * @var array
     */
    protected $casts = [
        'private_data' => Encrypted::class,
        'private_int' => EncryptedInteger::class,
        'private_float' => EncryptedFloat::class,
        'private_collection' => EncryptedCollection::class,
    ];
}

I’ve also put together another package called Eloquent AES which allows you to use AES-256-CBC encryption for your eloquent model data. This creates a separate Eloquent key which is used to encrypt/decrypt during casting.

<?php
namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use RichardStyles\EloquentAES\Casts\AESEncrypted;

class SalesData extends Model
{
    /**
     * The attributes that should be cast.
     *
     * @var array
     */
    protected $casts = [
        'private_data' => AESEncrypted::class,
    ];
}

This simply creates another instance of the Encrypter class within laravel using a different config key. This second package was created because people should be able to choose the method of encryption and how that choice affects other areas of their applications.

Filed in:
News

WASHINGTON, D.C.—President Trump held an emergency press conference. While most expected it to be an update on either the coronavirus or the recent civil unrest, the conference was instead all about the cool new calculator watch Trump had obtained.

“Look at this thing!” Trump told the press, showing off the black Casio watch on his wrist. “I can do math anywhere. Even hard stuff. This changes everything.”

Trump then demonstrated, using the watch to calculate a 15% tip on a $60 well-done steak. “And like that, I can answer any math problem instantly,” he bragged. “I’m basically unstoppable now. Ask me anything.”

A reporter from the Washington Post stood up. “With the ongoing pandemic and protests still–”

“No, a math question, you dummies!” Trump interrupted. “And put decimals in it. Make it hard.”

“34.7 times 63.1,” offered a correspondent from OAN.

Trump plugged away at his watch. “2,189.57!” Trump proudly announced.

Trump then tried to calculate what each American’s personal share of the national debt was, but he had to give up, as the calculator watch only went up to eight digits.

Get the Source Code: Click here to get the source code you’ll use to learn about Django view authorization in this tutorial.

$ python -m pip install django==3.0.7
$ django-admin startproject Blog
$ cd Blog
$ python manage.py startapp core
$ mkdir templates
$ python manage.py migrate
$ python manage.py createsuperuser
Username: superuser
Email address: superuser@example.com
Password:
Password (again):

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
 "core",
]

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
 "DIRS": [os.path.join(BASE_DIR, "templates")],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [
                "django.template.context_processors.debug",
                "django.template.context_processors.request",
                "django.contrib.auth.context_processors.auth",
                "django.contrib.messages.context_processors.messages",
            ],
        },
    },
]

Note: Django 3.1 has moved from using the os library to pathlib and no longer imports os by default. If you’re using Django 3.1, then you need to either add import os above the TEMPLATES declaration or convert the "DIRS" entry to use pathlib instead.

from django.db import models

class Blog(models.Model):
    title = models.CharField(max_length=50)
    content = models.TextField()

from django.http import HttpResponse
from django.shortcuts import render, get_object_or_404
from core.models import Blog

def listing(request):
    data = {
        "blogs": Blog.objects.all(),
    }

    return render(request, "listing.html", data)

def view_blog(request, blog_id):
    blog = get_object_or_404(Blog, id=blog_id)
    data = {
        "blog": blog,
    }

    return render(request, "view_blog.html", data)