PHPackages                             tourze/cookie-encrypt-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. tourze/cookie-encrypt-bundle

ActiveLibrary[Security](/categories/security)

tourze/cookie-encrypt-bundle
============================

A Symfony Bundle for automatically encrypting and decrypting specific cookies

0.0.4(11mo ago)06MITPHPPHP ^8.1CI passing

Since Apr 28Pushed 4mo ago1 watchersCompare

[ Source](https://github.com/tourze/cookie-encrypt-bundle)[ Packagist](https://packagist.org/packages/tourze/cookie-encrypt-bundle)[ RSS](/packages/tourze-cookie-encrypt-bundle/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (4)Dependencies (9)Versions (5)Used By (0)

Cookie Encrypt Bundle
=====================

[](#cookie-encrypt-bundle)

[English](README.md) | [中文](README.zh-CN.md)

[![PHP Version](https://camo.githubusercontent.com/306b72111fb5a57ba277f7820bdaf0c1e17327ce3bbfd42c967d8b3970de1911/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f746f75727a652f636f6f6b69652d656e63727970742d62756e646c652e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/tourze/cookie-encrypt-bundle)[![Latest Version](https://camo.githubusercontent.com/e2a73e283c846735eb1c5fc0dd216d3c6e5cff0b295233047b9afafe566b10c4/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f746f75727a652f636f6f6b69652d656e63727970742d62756e646c652e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/tourze/cookie-encrypt-bundle)[![License](https://camo.githubusercontent.com/58bd85e3157383b5926114b680491f33c7a736610bde524671b13516f90351e8/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f746f75727a652f636f6f6b69652d656e63727970742d62756e646c652e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/tourze/cookie-encrypt-bundle)[![Total Downloads](https://camo.githubusercontent.com/d8c40b7e0fd118ac4aef248da52e65071d23ba3030607d7868207a4ac1c35d3b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f746f75727a652f636f6f6b69652d656e63727970742d62756e646c652e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/tourze/cookie-encrypt-bundle)

A Symfony Bundle for automatically encrypting and decrypting specific cookies, particularly useful for deployment environments with strict WAF (Web Application Firewall) rules, such as Azure.

Features
--------

[](#features)

- Automatic encryption of specified cookies in responses
- Automatic decryption of specified cookies in requests
- Uses XOR encryption algorithm with base64 encoding
- Zero configuration after initial setup
- Seamless integration with Symfony's event system

Requirements
------------

[](#requirements)

- PHP 8.1 or higher
- Symfony 6.4 or higher

Installation
------------

[](#installation)

Install via Composer:

```
composer require tourze/cookie-encrypt-bundle
```

Configuration
-------------

[](#configuration)

### 1. Set Encryption Key

[](#1-set-encryption-key)

Add the encryption key to your `.env` file:

```
COOKIE_XOR_SECURITY_KEY=your_secure_key_here
```

⚠️ **Important**:

- Use a strong, random encryption key
- Keep the key secret and never commit it to version control
- Consider using different keys for different environments

### 2. Register the Bundle

[](#2-register-the-bundle)

If not using Symfony Flex, register the bundle in `config/bundles.php`:

```
return [
    // ...other bundles
    Tourze\CookieEncryptBundle\CookieEncryptBundle::class => ['all' => true],
];
```

Usage
-----

[](#usage)

Once installed and configured, the bundle automatically handles encryption/decryption for the following cookies:

- `sf_redirect` - Symfony's redirect cookie

The bundle works transparently:

- **On Request**: Automatically decrypts encrypted cookies before your application processes them
- **On Response**: Automatically encrypts cookies before sending them to the client

### How It Works

[](#how-it-works)

1. When a request arrives, the `CookieEncryptSubscriber` checks for encrypted cookies
2. If found, it decrypts them using the XOR algorithm and replaces the encrypted values
3. Your application works with the decrypted values normally
4. Before sending the response, the subscriber encrypts the cookie values again

Advanced Configuration
----------------------

[](#advanced-configuration)

### Custom Cookie Names

[](#custom-cookie-names)

To encrypt additional cookies, extend the `CookieEncryptSubscriber` class:

```
namespace App\EventSubscriber;

use Tourze\CookieEncryptBundle\EventSubscriber\CookieEncryptSubscriber;

class CustomCookieEncryptSubscriber extends CookieEncryptSubscriber
{
    protected array $names = [
        'sf_redirect',
        'my_custom_cookie',
        'another_cookie',
    ];
}
```

Then override the service definition in your `config/services.yaml`:

```
services:
    Tourze\CookieEncryptBundle\EventSubscriber\CookieEncryptSubscriber:
        class: App\EventSubscriber\CustomCookieEncryptSubscriber
```

Security Considerations
-----------------------

[](#security-considerations)

- The XOR encryption is designed for WAF bypass, not cryptographic security
- Always use HTTPS in production to prevent man-in-the-middle attacks
- Rotate encryption keys periodically
- Store encryption keys securely (use Symfony secrets management)

Testing
-------

[](#testing)

Run the test suite:

```
# From the monorepo root
./vendor/bin/phpunit packages/cookie-encrypt-bundle/tests

# Run with PHPStan
php -d memory_limit=2G ./vendor/bin/phpstan analyse packages/cookie-encrypt-bundle
```

Troubleshooting
---------------

[](#troubleshooting)

### InvalidEncryptionKeyException

[](#invalidencryptionkeyexception)

This exception is thrown when:

- The `COOKIE_XOR_SECURITY_KEY` environment variable is not set
- The encryption key is empty or contains only whitespace

**Solution**: Ensure you have set a valid encryption key in your `.env` file.

### Cookies Not Being Encrypted

[](#cookies-not-being-encrypted)

Check that:

1. The bundle is properly registered
2. The encryption key is set
3. The cookie name is in the list of cookies to encrypt

Contributing
------------

[](#contributing)

Please see the main monorepo README for contribution guidelines.

License
-------

[](#license)

MIT

###  Health Score

30

—

LowBetter than 65% of packages

Maintenance65

Regular maintenance activity

Popularity4

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity39

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~15 days

Total

4

Last Release

332d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e354fdb316da535dfa8ba2e9193a473c403b6bc6fb9170778d1dc50e304c6e9d?d=identicon)[tourze](/maintainers/tourze)

---

Top Contributors

[![tourze](https://avatars.githubusercontent.com/u/13899502?v=4)](https://github.com/tourze "tourze (1 commits)")

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/tourze-cookie-encrypt-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/tourze-cookie-encrypt-bundle/health.svg)](https://phpackages.com/packages/tourze-cookie-encrypt-bundle)
```

###  Alternatives

[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.4k5.6M650](/packages/sylius-sylius)[shopware/platform

The Shopware e-commerce core

3.3k1.5M3](/packages/shopware-platform)[sulu/sulu

Core framework that implements the functionality of the Sulu content management system

1.3k1.3M152](/packages/sulu-sulu)[simplesamlphp/simplesamlphp

A PHP implementation of a SAML 2.0 service provider and identity provider.

1.1k12.4M193](/packages/simplesamlphp-simplesamlphp)[prestashop/prestashop

PrestaShop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers.

9.0k15.4k](/packages/prestashop-prestashop)[contao/core-bundle

Contao Open Source CMS

1231.6M2.3k](/packages/contao-core-bundle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)