- Does gracious/doctrine-encryption-bundle work with Laravel?
- Not natively. It is a Symfony bundle that registers a Doctrine DBAL custom type and has no Laravel service provider, no Eloquent integration, and no Composer extra.laravel configuration. In a Laravel application it is only usable through laravel-doctrine/orm, where you register the type under dbal.types in config/doctrine.php and declare encrypted columns with that type name.
- How do I install and configure the encryption type in Doctrine?
- Install it with Composer as gracious/doctrine-encryption-bundle, then register the bundle in Symfony or, for Laravel Doctrine, add the custom type to dbal.types in config/doctrine.php. Each sensitive column must be declared with the custom type name rather than string or text, and the column itself must be TEXT or BLOB. Encryption keys are typically read from a Symfony parameter or environment variable, so in Laravel you need a bridge that makes the key reachable from the container.
- How does attribute-driven field encryption work on Doctrine entities?
- The bundle registers a Doctrine DBAL custom type that intercepts convertToDatabaseValue and convertToPHPValue. An attribute on the entity field marks it for encryption, and the type transparently encrypts on write and decrypts on read. Your entities, repositories, and persistence code keep working as usual, which keeps crypto logic out of domain code.
- Can I query, filter, sort, or uniquely index encrypted Doctrine columns?
- No. The encryption type is almost certainly non-deterministic, so encrypted columns cannot be used in WHERE clauses, ORDER BY, LIKE searches, or unique indexes. Any product requirement that needs lookup on an encrypted field requires a separate blind-index sidecar column. Plan for that before adopting the bundle.
- Which cipher does the bundle use and is encryption authenticated?
- The available evaluation does not confirm the cipher, so you must verify before production. Ask the maintainer whether it uses libsodium secretbox or OpenSSL AES-GCM, whether the mode is AEAD authenticated, whether the nonce is random per write, and whether a KDF is applied to the configured key. Also confirm whether there is any key rotation or re-encryption path.
- Is this bundle safe for production or regulated data?
- Treat it with caution. It has roughly 5 stars, zero dependents, single-agency authorship, and no third-party security review, and unaudited cipher code is a category of risk that star count alone cannot offset for regulated data. For Eloquent models you should use Laravel's built-in encrypted cast and Crypt facade instead, backed by a maintained and widely deployed library.
- How do I migrate existing plaintext columns to encrypted columns?
- Encryption rollout is a data migration, not a config change. Add nullable shadow TEXT columns instead of altering in place, backfill with a chunked Artisan or console command, and dual-write during the transition window. Then cut reads to the encrypted column, verify, drop the plaintext column, and retain a plaintext backup for a defined rollback window before destroying it deliberately.
- Which Laravel, Symfony, PHP, and DBAL versions are supported, and is it maintained?
- Confirm DBAL 3.x versus 4.x support, Symfony 6 and 7 constraints, and PHP 8.2+ compatibility before pinning the package. DBAL 3 to 4 changed custom type registration semantics, so pin exact versions and verify major version alignment. Also check release cadence and whether the bundle's type name collides with existing types in your project.
- How should I test encryption round-trip and decrypt failure behavior?
- Start with one low-sensitivity column in a non-production environment. Prove round-trip correctness, confirm what happens on corrupted ciphertext such as a silent null versus an exception, measure payload size impact, and check query-plan impact. Only expand after those checks pass.
- What are the alternatives for encrypting Doctrine fields in a Laravel app?
- For Eloquent, use Laravel's encrypted cast and Crypt facade rather than a Symfony bundle. For Doctrine-in-Laravel, consider a thin in-house DBAL custom type that wraps Laravel's own Encrypter, giving you the same transparency with a dependency you already trust and can patch. Compare that against adopting this bundle plus laravel-doctrine/orm and accepting the audit burden.