skills.rest
orangehrm
orangehrmOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-primitives

Implement AES-256-GCM encryption, bcrypt hashing, and CSRF protection for OrangeHRM.

1.1k|746|Updated Jan 5, 2017
Search Tags:#security#cryptography#csrf#password hashing#orangehrm#field encryption
One-click install
npx skills add https://github.com/orangehrm/orangehrm --skill security-primitives
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-primitives
Source: https://github.com/orangehrm/orangehrm/tree/main/.agents/skills/security-primitives
Command: npx skills add https://github.com/orangehrm/orangehrm --skill security-primitives

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill eliminates the need to rebuild OrangeHRM's core security primitives from scratch, reducing the risk of introducing critical vulnerabilities when handling sensitive employee data, user passwords, and form submissions. It provides pre-vetted, production-ready patterns for encryption, password hashing, and CSRF protection that align with the project's existing implementation.

Core Features & Use Cases

  • Field-level encryption at rest: Implements AES-256-GCM encryption for sensitive data (SSN, salary, SMTP passwords) with backward compatibility for legacy AES-128-ECB ciphertext, plus the full encrypt-on-write/decrypt-on-read EntityListener pattern.
  • Secure password hashing: Centralizes bcrypt password hashing with a fixed cost factor, eliminating inconsistent or insecure custom password handling.
  • CSRF token management: Provides standard Symfony-based CSRF protection for sensitive form submissions, aligned with OrangeHRM's authentication flow.
  • Use case: When adding a new sensitive column to an OrangeHRM entity, use this skill to implement the full encryption workflow (migration, entity configuration, listener callbacks) without introducing security flaws.

Quick Start

Use this skill to implement secure field-level encryption for a new sensitive employee data column in your OrangeHRM instance, following the project's established encrypt-on-write and decrypt-on-read pattern.

Frequently Asked Questions about security-primitives

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add field-level encryption to a new sensitive database column in OrangeHRM?▼

To add field-level encryption in OrangeHRM, implement the AES-256-GCM encrypt-on-write and decrypt-on-read EntityListener pattern. This provides full backward compatibility for legacy AES-128-ECB ciphertext while securing sensitive data at rest.

What is the correct way to hash user passwords in the OrangeHRM codebase?▼

The correct way to hash user passwords in OrangeHRM is using centralized bcrypt password hashing with a fixed cost factor. This approach eliminates inconsistent custom implementations and ensures secure handling for user entities.

Can I use AES-256-GCM encryption while maintaining backward compatibility with legacy AES-128-ECB data?▼

Yes, you can use AES-256-GCM encryption with backward compatibility for legacy AES-128-ECB ciphertext. The project's security primitives support decrypting older ciphertext while writing new encrypted data using the stronger AES-256-GCM standard.

What is the best way to implement CSRF protection for sensitive forms in a Symfony application?▼

The best way to implement CSRF protection for sensitive Symfony forms is using standard Symfony-based CSRF token management aligned with OrangeHRM's authentication flow. This ensures consistent and vetted protection for sensitive form submissions.

Why does my custom password hashing implementation fail to meet OrangeHRM security requirements?▼

Custom password hashing fails OrangeHRM security requirements because the project mandates centralized bcrypt hashing with a fixed cost factor. Inconsistent or insecure custom password handling introduces critical vulnerabilities when managing user entities.

When do I need to use field-level encryption at rest for OrangeHRM entities?▼

You need field-level encryption at rest for OrangeHRM entities when handling sensitive employee data like SSN, salary, or SMTP passwords. It secures database columns using AES-256-GCM encryption via an encrypt-on-write and decrypt-on-read EntityListener pattern.

Related Skills

Explore More Software Engineering Skills→
jshsakurajshsakura
22

symfony-specialist

Implement minimal safe Symfony changes across routing, controllers, services, and security.

Community
Advanced
RepairYourTechRepairYourTech
6

crypto-patterns

Implement cryptographic patterns for password hashing, encryption, and JWT authentication.

Community
Advanced
moasqmoasq
32

authentication

Manage authentication architecture with auth methods, services, guards, and sessions for Swift apps.

Community
Advanced
DevelopersCoffeeDevelopersCoffee
3

cwe-327-weak-cryptography

Replace weak cryptographic algorithms with secure alternatives in Java code.

Official
Intermediate