lombokclarion/security

Official, non-core security package: Argon2id hashing, stateless CSRF, RateLimit, SecurityHeaders, Encrypted<T> field wrapper, and FormRequest validation.

v2.1.0 2026-08-08 17:25 UTC

Requires

• php: >=8.3
• ext-openssl: *
• lombokclarion/http: *

Apache-2.0

Published on Packagist.org on 2026-08-09 00:51 UTC

README

Argon2id hashing, CSRF double-submit, rate limiting, AES-256-GCM encryption, security headers.

[READ-ONLY] This is a subtree split of the LombokClarion monorepo.
Do not send pull requests here — contribute to the main repository instead.

Install

composer require lombokclarion/security

Namespace

LombokClarion\Security

What's Inside

Class	Role
PasswordHasher	Interface: hash(), verify(), needsRehash()
Argon2idPasswordHasher	Argon2id with OWASP-minimum cost validation at boot
Encrypter	Interface: encrypt(), decrypt()
AesGcmEncrypter	AES-256-GCM authenticated encryption
Encrypted	Typed wrapper for encrypted values in domain models
CsrfTokenManager	Stateless HMAC double-submit CSRF tokens
ValidateCsrf	Middleware: validates CSRF on mutating requests
RateLimitStore	Backend interface for rate-limit counters
InMemoryRateLimitStore	Per-process in-memory rate limiting
RateLimit	Middleware factory: RateLimit::perMinute(n, $store)
SecurityHeaders	Middleware: CSP, HSTS, X-Frame-Options, etc.
SecurityConfig	Security configuration value object
FormRequest	Secure form request (extends validation FormRequest)

Usage

// Password hashing
$hasher = new Argon2idPasswordHasher();
$hash = $hasher->hash('secret');
$hasher->verify('secret', $hash); // true

// Encryption
$encrypter = new AesGcmEncrypter($appKey);
$cipher = $encrypter->encrypt('sensitive data');
$plain = $encrypter->decrypt($cipher);

// CSRF (in routes)
$router->post('/form', [Controller::class, 'submit'], [
    ValidateCsrf::class,
]);

// Rate limiting
$router->post('/login', [AuthController::class, 'login'], [
    RateLimit::perMinute(5, $rateLimitStore),
]);

License

Apache-2.0 — see LICENSE in the main repository.