Secure PHP Apps with Symfony & MongoDB: Full Course on Queryable Encryption

Introduction to Secure Application Development

• 💡 The course emphasizes building highly secure web applications due to the constant threat of data breaches.
• 🔑 Standard encryption practices are insufficient; systems must protect data throughout its life cycle: at rest, in transit, and in use.
• 🎯 The tutorial guides users through building a financial transactions application from scratch, focusing on cryptographic security.

Technology Stack and Setup

• 🚀 The chosen stack includes PHP for backend logic, Symfony for structure and best practices, and MongoDB Atlas for the database.
• 🔗 Doctrine MongoDB ODM is used to map PHP objects to MongoDB documents, simplifying data interaction.
• 🔒 MongoDB's Queryable Encryption (QE) is a core feature, enabling queries on encrypted data without decryption on the server.
• 🛠️ Initial setup involves installing PHP, Composer, Symfony CLI, the MongoDB PHP extension, and necessary Symfony bundles.

Database and Encryption Configuration

• ☁️ MongoDB Atlas is configured, including creating a cluster and setting up connection details via environment variables.
• 🔑 A local master key is generated for encryption, with a note that production environments would use a Key Management Service (KMS).
• ⚙️ Configuration in doctrine_mongodb.yaml enables auto-encryption and specifies the path to the MongoDB crypt shared library and KMS provider.

Document Classes and Data Modeling

• 📄 Document classes (e.g., Account.php, Transaction.php) define data models and map to MongoDB collections.
• 🔐 Fields like accountNumber, socialSecurityNumber, and balance are configured for encryption using Doctrine ODM attributes.
• 🔍 Queryable encryption is specified for fields like accountNumber and socialSecurityNumber to allow equality checks, and for balance to enable range queries.
• 🔒 Fields like cardNumber, CVV, and expiryDate use randomized encryption for maximum security when no queries are needed.

Financial Service and Controller Logic

• 🧠 The Financial Service class contains the application's business logic, handling account and transaction creation/retrieval.
• 🔌 The Controller exposes the Financial Service as API endpoints, receiving web requests and returning JSON responses.
• 📦 Dependency injection is used to inject the Document Manager into the service and the Financial Service into the controller, promoting clean code.
• 🚫 The service layer is decoupled from encryption details; it works with plain data objects, with Doctrine ODM handling encryption transparently.

Creating Collections and Demo Data

• 🏗️ MongoDB collections are created with correct encryption metadata using doctrine_mongodb:schema:create.
• 📝 A console command (app:demo-data) is created to populate the database with sample accounts and transactions.
• ✅ Data is inserted, with sensitive fields like account numbers and social security numbers being encrypted at rest in MongoDB Atlas.

Frontend and Application Testing

• 🌐 A simple index.html file with JavaScript interacts with the API endpoints to create accounts, transactions, and perform queries.
• 🧪 The application is started using symfony server:start, and the user interface is tested by creating accounts, performing queries on encrypted data (e.g., by account number, balance range), and creating transactions.
• 📊 A demonstration shows that data is encrypted in MongoDB Atlas (appearing as asterisks) but is decrypted and usable within the application, showcasing the effectiveness of Queryable Encryption.