typo3-security

# TYPO3 Security Hardening > Source: https://github.com/dirnbauer/webconsulting-skills > **Compatibility:** TYPO3 v14.x > All security configurations in this skill work on TYPO3 v14. > **TYPO3 API First:** Always use TYPO3's built-in APIs, core features, and established conventions before creating custom implementations. Do not reinvent what TYPO3 already provides. Always verify that the APIs and methods you use exist and are not deprecated in TYPO3 v14 by checking the official TYPO3 documentation. ## 1. Critical Configuration Settings ### `config/system/settings.php` (TYPO3 v14) ```php <?php return [ 'BE' => [ // Disable debug in production 'debug' => false, // Session security (example hardening values — tune for proxies/load balancers) 'lockIP' => 4, // Example: bind backend sessions to the full IPv4 address 'lockIPv6' => 8, // Lock to IPv6 prefix 'sessionTimeout' => 3600, // 1 hour session timeout 'lockSSL' => true, // Example: require HTTPS for backend requests // Password policy (TYPO3 v14) 'passwordHashing' => [ 'className' => \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class, 'options' => [], ], ], 'FE' => [ 'debug' => false, 'lockIP' => 0, // Common for frontend sessions; mobile users / proxies often change IPs 'sessionTimeout' => 86400, // `lockSSL` is BE-only (there is no `FE.lockSSL`) — enforce HTTPS for the frontend at the **web server / proxy** and send **HSTS** (`Strict-Transport-Security: max-age=31536000; includeSubDomains`) for production hosts 'passwordHashing' => [ 'className' => \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class, 'options' => [], ], ], 'SYS' => [ // NEVER display errors in production 'displayErrors' => 0, 'devIPmask' => '', // No dev IPs in production 'errorHandlerErrors' => E_ALL & ~E_NOTICE & ~E_DEPRECATED, 'exceptionalErrors' => E_ALL & ~E_NOTICE & ~E_WARNING & ~E_DEPRECATED, // Encryption key (generate unique per installation) 'encryptionKey' => 'generate-unique-key-per-installation', // Trusted hosts pattern (CRITICAL) — Core wraps the pattern in `/^...$/`; omit `^` and `$`. Avoid `.*example\\.com` (without `\\.` before `example` — matches `evil-example.com`). Note: `.*\\.example\\.com` requires a subdomain and won't match bare `example.com`. 'trustedHostsPattern' => '(www\\.)?example\\.com', // File handling security 'textfile_ext' => 'txt,html,htm,css,js,tmpl,ts,typoscript,xml,svg', 'mediafile_ext' => 'gif,jpg,jpeg,png,webp,svg,pdf,mp3,mp4,webm', // Security feature toggles — names and availability differ by minor release; confirm in Core docs for your exact version 'features' => [ 'security.backend.enforceReferrer' => true, // Frontend CSP toggles (names stable from v12+; confirm in reference for your minor) 'security.frontend.enforceContentSecurityPolicy' => false, 'security.frontend.reportContentSecurityPolicy' => false, ], ], 'LOG' => [ 'writerConfiguration' => [ \Psr\Log\LogLevel::WARNING => [ \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [ 'logFile' => 'var/log/typo3-warning.log', ], ], \Psr\Log\LogLevel::ERROR => [ \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [ 'logFile' => 'var/log/typo3-error.log', ], \TYPO3\CMS\Core\Log\Writer\SyslogWriter::class => [], ], ], ], ]; ``` ## 2. Trusted Hosts Pattern **CRITICAL**: Always configure `trustedHostsPattern` to prevent host header injection. ```php // ❌ DANGEROUS - Allows any host 'trustedHostsPattern' => '.*', // ✅ SECURE - Explicit host list (Core adds `/^...$/` around the pattern) 'trustedHostsPattern' => '(?:example\\.com|www\\.example\\.com)', // ✅ SECURE - Regex for subdomains (tie to your registrable domain) 'trustedHostsPattern' => '(.*\\.)?example\\.com', // Development with DDEV 'trustedHostsPattern' => '(?:(?:.*\\.)?example\\.com|.*\\.ddev\\.site)', ``` ## 3. File System Security ### `fileDenyPattern` (upload / public file access) Keep Core’s deny list strict — extend only when you understand the risk: > **Warning:** setting `fileDenyPattern` **replaces** Core’s default pattern entirely. Always start from the v14 default (`\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi)(\\..*)?$|\\.pl$|^\\.htaccess$`) and append — never drop `pht`, `phpsh`, `shtml`, or `^\.htaccess$`. ```php // Example: keep Core's v14 default and append extra executable extensions (adjust to your policy) $GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern'] = '\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi|sh|bash|py|asp|aspx|jsp)(\\..*)?$|\\.pl$|^\\.htaccess$'; ``` ### Directory Permissions ```bash # Set correct ownership (adjust www-data to your web user) chown -R www-data:www-data /var/www/html # Directories: 2775 (group sticky) find /var/www/html -type d -exec chmod 2775 {} \; # Files: 664 find /var/www/html -type f -exec chmod 664 {} \; # Configuration files: more restrictive chmod 660 config/system/settings.php chmod 660 config/system/additional.php # var directory (writable) chmod -R 2775 var/ # public/fileadmin (writable for uploads) chmod -R 2775 public/fileadmin/ chmod -R 2775 public/typo3temp/ ``` ### Critical Files to Protect Never expose these in `public/`: ``` ❌ var/log/ ❌ config/ ❌ .env ❌ composer.json ❌ composer.lock ❌ .git/ ❌ vendor/ (should be outside public) ``` ### .htaccess Security (Apache) ```apache # public/.htaccess additions # Block access to hidden files <FilesMatch "^\."> Require all denied </FilesMatch> # Block access to sensitive file types <FilesMatch "\.(sql|sqlite|bak|backup|log|sh)$"> Require all denied </FilesMatch> # Block PHP execution in upload directories <Directory "fileadmin"> <FilesMatch "\.php$"> Require all denied </FilesMatch> </Directory> # Security headers <IfModule mod_headers.c> Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()" </IfModule> ``` ### Nginx Security ```nginx # Block hidden files location ~ /\. { deny all; } # Block sensitive directories location ~ ^/(config|var|vendor)/ { deny all; } # Block PHP in upload directories location ~ ^/fileadmin/.*\.php$ { deny all; } # Security headers add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; ``` ## 4. Install Tool Security ### Disable Install Tool ```bash # Remove enable file after installation # Composer-based TYPO3 v14: file is in var/transient/ rm var/transient/ENABLE_INSTALL_TOOL ``` ### Secure Install Tool Password Generate strong password and store securely: ```bash # Generate random password openssl rand -base64 32 ``` Set the hashed password via the Install Tool or an environment-specific `config/system/additional.php`; never commit a placeholder or empty string. ### IP Restriction for Install Tool Restrict the Install Tool entry point (`/typo3/install.php` on Composer-based v14) to trusted IPs at the web-server level: ```apacheconf # Apache: in the vhost or .htaccess <LocationMatch "^/typo3/install\.php"> Require ip 203.0.113.0/24 Require ip 198.51.100.42 </LocationMatch> ``` ```nginx # Nginx location = /typo3/install.php { allow 203.0.113.0/24; allow 198.51.100.42; deny all; # ...existing fastcgi_pass / include snippet... } ``` > Note: `$GLOBALS['TYPO3_CONF_VARS']['SYS']['devIPmask']` only governs exposure of dev/debug tooling (e.g. the admin panel and debug output) — it does **not** restrict or authenticate the Install Tool. Lock the Install Tool down at the web server (above) in addition to setting a strong `installToolPassword`. ## 5. Backend User Security ### Strong Password Policy (TYPO3 v14) ```php <?php // ext_localconf.php of site extension $GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'default'; // policy *name* only $GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies']['default'] = [ 'validators' => [ \TYPO3\CMS\Core\PasswordPolicy\Validator\CorePasswordValidator::class => [ 'options' => [ 'minimumLength' => 12, 'upperCaseCharacterRequired' => true, 'lowerCaseCharacterRequired' => true, 'digitCharacterRequired' => true, 'specialCharacterRequired' => true, ], ], \TYPO3\CMS\Core\PasswordPolicy\Validator\NotCurrentPasswordValidator::class => [], ], ]; ``` ### Multi-Factor Authentication (TYPO3 v14) MFA is built into TYPO3 v14. Users can configure in: **User Settings > Account Security** Supported providers: - TOTP (Time-based One-Time Password) - Recovery Codes Configure MFA enforcement in **`config/system/settings.php`** via [`$GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa']`](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Typo3ConfVars/BE.html#typo3confvars-be-requiremfa): `0` disabled, `1` all users, `2` non-admins, `3` admins only, **`4` system maintainers only** — confirm exact semantics in Core docs for your minor), or per user/group with **user TSconfig** [`auth.mfa.required`](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Auth.html): ```typoscript # User or group TSconfig — require MFA for those accounts (overrides global when set) auth.mfa.required = 1 ``` See [Multi-factor authentication](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/Authentication/MultiFactorAuthentication/Index.html). ### Backend Access Logging ```php // Log all backend logins $GLOBALS['TYPO3_CONF_VARS']['LOG']['TYPO3']['CMS']['Backend']['Authentication']['writerConfiguration'] = [ \Psr\Log\LogLevel::INFO => [ \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [ 'logFile' => 'var/log/backend-auth.log', ], ], ]; ``` ## 6. Content Security Policy (CSP) ### Built-in CSP (TYPO3 v14) TYPO3 v14 has built-in CSP support. Enable it: Enable CSP through `config/system/settings.php` / Install Tool. Frontend toggles (names may evolve — verify in Core for your minor) commonly include: `$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.enforceContentSecurityPolicy']` and `security.frontend.reportContentSecurityPolicy`. **Backend CSP is enforced by default since v13** — there is no equivalent FE-style toggle for BE. ### CSP Configuration via Events (TYPO3 v14) ```php <?php declare(strict_types=1); namespace Vendor\Extension\EventListener; use TYPO3\CMS\Core\Attribute\AsEventListener;