---
title: "BE - backend configuration"
manual: "TYPO3 Explained"
version: "12.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be@12.4"
source: "Configuration/Typo3ConfVars/BE.rst"
rendered: "2026-10-21T15:29:37+00:00"
---
> [!WARNING]
> **Attention**
>
> TYPO3 v12 has reached end-of-life as of April 30th 2026 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v12 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).
# BE - backend configuration {#typo3confvars-be}
The following configuration variables can be used to configure settings for
the TYPO3 backend:
> [!NOTE]
> The configuration values listed here are keys in the global PHP array
> `$GLOBALS['TYPO3_CONF_VARS']['BE']`.
>
> This variable can be set in one of the following files:
>
> - [config/system/settings.php](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-settings@12.4)
> - [config/system/additional.php](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-additional@12.4)
- **languageDebug**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['languageDebug'\]'\]
- *Default:* false
Judging from translators feedback, the option is not used in practice:
Setting the toggle to true leads to a massively convoluted backend
experience that breaks tons of CSS and renders the backend so unusable that
it is hardly a benefit at all. The setting will be removed with TYPO3 v13.If enabled, language labels will be shown with additional debug information.
- **fileadminDir**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['fileadminDir'\]
- *Default:* 'fileadmin/'
Path to the primary directory of files for editors. This is relative to
the public web dir. DefaultStorage will be created with that configuration.
Do not access manually but via
`\TYPO3\CMS\Core\Resource\ResourceFactory::getDefaultStorage()`.
- **lockRootPath**
- *Type:* array of file paths
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockRootPath'\]
- *Default:* `[]`
This option has been extended to support an array of root path prefixes to
allow for multiple storages to be listed (a string was expected before).It is suggested to use the new array-based syntax, which will be applied
automatically once this setting is updated via Install Tool configuration
wizard. Migration:// Before
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = '/var/extra-storage';
// After
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = [
'/var/extra-storage1/',
'/var/extra-storage2/',
];See also the security bulletin "Path Traversal in TYPO3 File Abstraction Layer Storages".These absolute paths are used to evaluate, if paths outside of the project
path should be allowed. This restriction also applies for the local driver
of the [File Abstraction Layer](https://docs.typo3.org/permalink/t3coreapi:fal@12.4).
> [!WARNING]
> **Attention**
>
> Trailing slashes are enforced automatically.
- **userHomePath**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['userHomePath'\]
- *Default:* ''
Combined folder identifier of the directory where TYPO3 backend users have
their home-dirs. A combined folder identifier looks like this:
`[storageUid]:[folderIdentifier]`. For Example `2:users/`.
A home for backend user 2 would be: `2:users/2/`. Ending slash required!
- **groupHomePath**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['groupHomePath'\]
- *Default:* ''
Combined folder identifier of the directory where TYPO3 backend groups have
their home-dirs. A combined folder identifier looks like this:
`[storageUid]:[folderIdentifier]`. For example `2:groups/`.
A home for backend group 1 would be: `2:groups/1/`. Ending slash required!
- **userUploadDir**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['userUploadDir'\]
- *Default:* ''
Suffix to the user home dir which is what gets mounted in TYPO3. For example
if the user dir is `../123_user/` and this value
is `/upload` then `../123_user/upload` gets mounted.
- **warning_email_addr**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['warning_email_addr'\]
- *Default:* ''
Email address that will receive notifications whenever an attempt to
login to the Install Tool is made. This address will also receive warnings
whenever more than 3 failed backend login attempts (regardless of user)
are detected within an hour.
Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-warning-email-addr@12.4).
- **warning_mode**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['warning_mode'\]
- *Default:* 0
- *Allowed values:* 1 0: Default: Do not send notification-emails upon backend-login 1: Send a notification-email every time a backend user logs in 2: Send a notification-email every time an **admin** backend user logs in
Send emails to `warning_email_addr` upon backend-login
Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-warning-mode@12.4).
- **passwordReset**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordReset'\]
- *Default:* true
Enable password reset functionality on the backend login for TYPO3 Backend
users. Can be disabled for systems where only LDAP or OAuth login is allowed.
Password reset will then still work on CLI and for admins in the backend.
- **passwordResetForAdmins**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordResetForAdmins'\]
- *Default:* true
Enable password reset functionality for TYPO3 Administrators. This will
affect all places such as backend login or CLI. Disable this option for
increased security.
- **requireMfa**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['requireMfa'\]
- *Default:* 0
- *Allowed values:* 0-4
- **0:**
Default: Do not require multi-factor authentication
- **1:**
Require multi-factor authentication for all users
- **2:**
Require multi-factor authentication only for non-admin users
- **3:**
Require multi-factor authentication only for admin users
- **4:**
Require multi-factor authentication only for system maintainers
Define users which should be required to set up
[multi-factor authentication](https://docs.typo3.org/permalink/t3coreapi:multi-factor-authentication@12.4).
- **recommendedMfaProvider**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['recommendedMfaProvider'\]
- *Default:* 'totp'
Set the identifier of the
[multi-factor authentication provider](https://docs.typo3.org/permalink/t3coreapi:multi-factor-authentication-included-providers@12.4),
recommended for all users.
- **loginRateLimit**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['loginRateLimit'\]
- *Default:* 5
Maximum amount of login attempts for the time interval in
[\[BE\]\[loginRateLimitInterval\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-loginratelimitinterval@12.4),
before further login requests will be denied. Setting this value to
`"0"` will disable login rate limiting.
- **loginRateLimitInterval**
- *Type:* string, PHP relative format
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['loginRateLimitInterval'\]
- *Default:* '15 minutes'
- *Allowed values:* '1 minute', '5 minutes', '15 minutes', '30 minutes'
Allowed time interval for the configured rate limit. Individual values
using
[PHP relative formats](https://www.php.net/manual/de/datetime.formats.relative.php)
can be set in `config/system/additional.php`.
- **loginRateLimitIpExcludeList**
- *Type:* string
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['loginRateLimitIpExcludeList'\]
- *Default:* ''
IP addresses (with `*`-wildcards) that are excluded from rate limiting.
Syntax similar to [\[BE\]\[IPmaskList\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-ipmasklist@12.4).
An empty value disables the exclude list check.
- **lockIP**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockIP'\]
- *Default:* 0
- *Allowed values:* 0-4
- **0:**
Default: Do not lock Backend User sessions to their IP address at all
- **1:**
Use the first part of the editors IPv4 address (for example "192.") as part of the session locking of Backend Users
- **2:**
Use the first two parts of the editors IPv4 address (for example "192.168") as part of the session locking of Backend Users
- **3:**
Use the first three parts of the editors IPv4 address (for example "192.168.13") as part of the session locking of Backend Users
- **4:**
Use the editors full IPv4 address (for example "192.168.13.84") as part of the session locking of Backend Users (highest security)
Session IP locking for backend users. See [\[FE\]\[lockIP\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-fe-lockip@12.4) for details.
Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-lockip@12.4).
- **lockIPv6**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockIPv6'\]
- *Default:* 0
- *Allowed values:* 0-8
- **0:**
Default: Do not lock Backend User sessions to their IP address at all
- **1:**
Use the first block (16 bits) of the editors IPv6 address (for example "2001:") as part of the session locking of Backend Users
- **2:**
Use the first two blocks (32 bits) of the editors IPv6 address (for example "2001:0db8") as part of the session locking of Backend Users
- **3:**
Use the first three blocks (48 bits) of the editors IPv6 address (for example "2001:0db8:85a3") as part of the session locking of Backend Users
- **4:**
Use the first four blocks (64 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3") as part of the session locking of Backend Users
- **5:**
Use the first five blocks (80 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319") as part of the session locking of Backend Users
- **6:**
Use the first six blocks (96 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e") as part of the session locking of Backend Users
- **7:**
Use the first seven blocks (112 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e:0370") as part of the session locking of Backend Users
- **8:**
Use the editors full IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e:0370:7344") as part of the session locking of Backend Users (highest security)
Session IPv6 locking for backend users. See [\[FE\]\[lockIPv6\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-fe-lockipv6@12.4) for details.
- **sessionTimeout**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['sessionTimeout'\]
- *Default:* 28800
Session time out for backend users in seconds. The value must be at least
180 to avoid side effects. Default is 28.800 seconds = 8 hours.
- **IPmaskList**
- *Type:* list
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['IPmaskList'\]
- *Default:* ''
Lets you define a list of IP addresses (with \*-wildcards) that are the
ONLY ones allowed access to ANY backend activity. On error an error header
is sent and the script exits. Works like IP masking for users
configurable through TSconfig.
See syntax for that (or look up syntax for the function
`\TYPO3\CMS\Core\Utility\GeneralUtility::cmpIP())`
Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-ipmasklist@12.4).
- **lockSSL**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockSSL'\]
- *Default:* false
If set, the backend can only be operated from an SSL-encrypted
connection (https). A redirect to the SSL version of a URL will happen
when a user tries to access non-https admin-urls
Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-lockssl@12.4).
- **lockSSLPort**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockSSLPort'\]
- *Default:* 0
Use a non-standard HTTPS port for lockSSL. Set this value if you use
lockSSL and the HTTPS port of your webserver is not 443.
- **cookieDomain**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['cookieDomain'\]
- *Default:* ''
Same as [$TYPO3_CONF_VARS\[SYS\]\[cookieDomain\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-cookiedomain@12.4)
but only for BE cookies. If empty, `$TYPO3_CONF_VARS[SYS][cookieDomain]`
value will be used.
- **cookieName**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['cookieName'\]
- *Default:* 'be_typo_user'
Set the name for the cookie used for the back-end user session
- **cookieSameSite**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['cookieSameSite'\]
- *Default:* 'strict'
- *Allowed values:* 'lax', 'strict', 'none'
- **lax:**
Cookies set by TYPO3 are only available for the current site,
third-party integrations are not allowed to read cookies, except for
links and simple HTML forms
- **strict:**
Cookies sent by TYPO3 are only available for the current site, never
shared to other third-party packages
- **none:**
Allow cookies set by TYPO3 to be sent to other sites as well,
please note - this only works with HTTPS connections
Indicates that the cookie should send proper information where the cookie
can be shared (first-party cookies vs. third-party cookies) in TYPO3 Backend.
- **showRefreshLoginPopup**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['showRefreshLoginPopup'\]
- *Default:* false
If set, the Ajax relogin will show a real popup window for relogin after
the count down. Some auth services need this as they add custom validation
to the login form. If its not set, the Ajax relogin will show an inline
relogin window.
- **adminOnly**
- *Type:* int
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['adminOnly'\]
- *Default:* 0
- *Allowed values:* -1 - +2
- **-1:**
Total shutdown for maintenance purposes
- **0:**
Default: All users can access the TYPO3 Backend
- **1:**
Only administrators / system maintainers can log in, CLI interface is disabled as well
- **2:**
Only administrators / system maintainers have access to the TYPO3 Backend, CLI executions are allowed as well
Restricts access to the TYPO3 Backend - especially useful when doing maintenance or updates
- **disable_exec_function**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['disable_exec_function'\]
- *Default:* false
Dont use exec() function (except for ImageMagick which is disabled by
`[GFX][im]` =0). If set, all file operations are done
by the default PHP-functions. This is necessary under Windows! On Unix the
system commands by exec() can be used, unless this is disabled.
- **compressionLevel**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['compressionLevel'\]
- *Default:* 0
- *Range:* 0-9
Determines output compression of BE output. Makes output smaller but slows
down the page generation depending on the compression level. Requires
- zlib in your PHP installation and
- special rewrite rules for `.css.gz` and `.js.gz`
(before version 12.0 the extension was `.css.gzip` and `.js.gzip`)
Please see `EXT:install/Resources/Private/FolderStructureTemplateFiles/root-htaccess`
for an example. Range `1`-`9`, where `1` is least
compression and `9` is greatest compression. `true` as value will set the
compression based on the PHP default settings (usually `5` ). Suggested and
most optimal value is `5`.
- **installToolPassword**
- *Type:* string
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['installToolPassword'\]
- *Default:* ''
The hash of the install tool password.
- **checkStoredRecords**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['checkStoredRecords'\]
- *Default:* true
If set, values of the record are validated after saving in DataHandler.
Disable only if using a database in strict mode.
- **checkStoredRecordsLoose**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['checkStoredRecordsLoose'\]
- *Default:* true
If set, make a loose comparison ( equals 0) when validating record
values after saving in DataHandler.
- **defaultUserTSconfig**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['defaultUserTSconfig'\]
Contains the default user TSconfig.
This variable should not be changed directly but by the following API function.
This makes your code less likely to break in the future.
**my_sitepackage/ext_localconf.php**
```php
/**
* Adding the default User TSconfig
*/
\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::addUserTSConfig('
@import 'EXT:my_sitepackage/Configuration/TsConfig/User/default.tsconfig'
');
```
Read more about
[Setting default User TSconfig](https://docs.typo3.org/m/typo3/reference-typoscript/12.4/en-us/UsingSettingTSconfig/UserTSconfig.html#usersettingdefaultusertsconfig).
- **defaultPageTSconfig**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['defaultPageTSconfig'\]
Contains the default page TSconfig.
Never set this configuration variable directly. Use the following methods instead:
TSconfig stored in a file EXT:my_sitepackage/Configuration/page.tsconfig
will be automatically loaded before the content of
$TYPO3_CONF_VARS[SYS][defaultPageTSconfig].Page TSconfig stored in files like
[`EXT:my_sitepackage/Configuration/page.tsconfig`](../../ExtensionArchitecture/FileStructure/Configuration/PageTsconfig.md#file-extension-configuration-page-tsconfig) are loaded before
`$TYPO3_CONF_VARS[SYS][defaultPageTSconfig]`.
This is done during build-time and therefore more performant than the legacy way of
loading default Page Tsconfig during runtime by setting
`$TYPO3_CONF_VARS[SYS][defaultPageTSconfig]` or the API function
`ExtensionManagementUtility::addPageTSConfig`. It is therefore highly recommended
to migrate to using files like [`EXT:my_sitepackage/Configuration/page.tsconfig`](../../ExtensionArchitecture/FileStructure/Configuration/PageTsconfig.md#file-extension-configuration-page-tsconfig)
instead of setting this global variable.
Read more about
[Setting the Page TSconfig globally](https://docs.typo3.org/m/typo3/reference-typoscript/12.4/en-us/UsingSettingTSconfig/PageTSconfig.html#pagesettingdefaultpagetsconfig).
- **defaultPermissions**
- *Type:* array
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['defaultPermissions'\]
- *Default:* \[\]
This option defines the default page permissions (`show`, `edit`, `delete`,
`new`, `editcontent`). The following order applies:
- `defaultPermissions` from `\TYPO3\CMS\Core\DataHandling\PagePermissionAssembler`
- `$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions']` (the option described here)
- Page TSconfig via [TCEMAIN.permissions](https://docs.typo3.org/m/typo3/reference-typoscript/12.4/en-us/PageTsconfig/TceMain.html#pagetcemain-permissions-user-group)
Example (which reflects the default permissions):
**config/system/additional.php | typo3conf/system/additional.php**
```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions'] = [
'user' => 'show,edit,delete,new,editcontent',
'group' => 'show,edit,new,editcontent',
'everybody' => '',
];
```
If you want to deviate from the default permissions, for example by changing the everybody key,
you only need to modify the key you wish to change:
**config/system/additional.php | typo3conf/system/additional.php**
```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions'] = [
'everybody' => 'show',
];
```
- **defaultUC**
- *Type:* array
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['defaultUC'\]
- *Default:* \[\]
Defines the default user settings. The following order applies:
- `uc_default` in `\TYPO3\CMS\Core\Authentication\BackendUserAuthentication`
- `$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUC']` (the option described here)
- User TSconfig via [setup](https://docs.typo3.org/m/typo3/reference-typoscript/12.4/en-us/UserTsconfig/Setup.html#usersetup)
Example (which reflects the default user settings):
**config/system/additional.php | typo3conf/system/additional.php**
```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUC'] = [
'emailMeAtLogin' => 0,
'titleLen' => 50,
'edit_RTE' => '1',
'edit_docModuleUpload' => '1',
];
```
Visit the [setup](https://docs.typo3.org/m/typo3/reference-typoscript/12.4/en-us/UserTsconfig/Setup.html#usersetup) chapter of the User TSconfig guide for
a list of all available options.
- **customPermOptions**
- *Type:* array
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['customPermOptions'\]
- *Default:* \[\]
Array with sets of custom permission options. Syntax is:
**config/system/additional.php | typo3conf/system/additional.php**
```php
'key' => array(
'header' => 'header string, language split',
'items' => array(
'key' => array('label, language split','icon reference', 'Description text, language split')
)
)
```
Keys cannot contain characters any of the following characters: `:|,`.
- **fileDenyPattern**
- *Type:* text
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['fileDenyPattern'\]
- *Default:* ''
A perl-compatible and JavaScript-compatible regular expression (without
delimiters `/`) that - if it matches a filename - will deny the
file upload/rename or whatever.
For security reasons, files with multiple extensions have to be denied on
an Apache environment with mod_alias, if the filename contains a valid php
handler in an arbitrary position. Also, ".htaccess" files have to be denied.
Matching is done case-insensitive.
Default value is stored in class constant
`\TYPO3\CMS\Core\Resource\Security\FileNameValidator::FILE_DENY_PATTERN_DEFAULT`.
Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-filedenypattern@12.4).
- **interfaces**
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['interfaces'\]
This option was removed with TYPO3 v12.0.If a TYPO3 project really relies on this feature, create an
[XCLASS](https://docs.typo3.org/permalink/t3coreapi:xclasses@12.4) of `\TYPO3\CMS\Backend\Controller\LoginController`,
where also a custom Fluid template may be used.
- **explicitADmode**
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['explicitADmode'\]
The handling of $GLOBALS['TYPO3_CONF_VARS']['BE']['explicitADmode'] has been changed and
is now set using explicitAllow. Extensions should not assume this global array
key is set anymore as of TYPO3 Core v12. Extensions that need to stay compatible with v11
and v12 should instead use: $GLOBALS['TYPO3_CONF_VARS']['BE']['explicitADmode'] ?? 'explicitAllow'.
- **flexformForceCDATA**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['flexformForceCDATA'\]
- *Default:* 0
If set, will add CDATA to Flexform XML. Some versions of libxml have a bug
that causes HTML entities to be stripped from any XML content and this
setting will avoid the bug by adding CDATA.
- **versionNumberInFilename**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['versionNumberInFilename'\]
- *Default:* false
If enabled, included CSS and JS files loaded in the TYPO3 Backend will
have the timestamp embedded in the filename, ie. `filename.1269312081.js` .
This will make browsers and proxies reload the files if they change
(thus avoiding caching issues).
**IMPORTANT:** This feature requires extra `.htaccess` rules to
work (please refer to the
`typo3/sysext/install/Resources/Private/FolderStructureTemplateFiles/root-htaccess`
file shipped with TYPO3).
If disabled the last modification date of the file will be appended as a query-string.
- **debug**
- *Type:* bool
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['debug'\]
- *Default:* false
If enabled, the login refresh is disabled and pageRenderer is set to debug
mode. Furthermore the fieldname is appended to the label of fields. Use
this to debug the backend only!
- **toolbarItems**
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['toolbarItems'\]
This configuration variable has been removed in TYPO3 version 12.0. Setting
it has no effect.Starting with version 12.0 toolbar items implementing
`\TYPO3\CMS\Backend\Toolbar\ToolbarItemInterface` are automatically
registered by adding the tag `backend.toolbar.item`, if `autoconfigure`
is enabled in `Services.yaml`.
**Migration**
Remove `$GLOBALS['TYPO3_CONF_VARS']['BE']['toolbarItems']` from your
[`ext_localconf.php`](../../ExtensionArchitecture/FileStructure/ExtLocalconf.md#file-extension-ext-localconf-php) file. If `autoconfigure` is not enabled in
your `Configuration/Services.(yaml|php)`, add the tag
`backend.toolbar.item` to your toolbar item class.
- **HTTP**
- *Type:* array
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['HTTP'\]
Set HTTP headers to be sent with each backend request. Other keys than
`['Response']['Headers']` are ignored.
The default configuration:
```php
[
'Response' => [
'Headers' => [
'clickJackingProtection' => 'X-Frame-Options: SAMEORIGIN',
'strictTransportSecurity' => 'Strict-Transport-Security: max-age=31536000',
'avoidMimeTypeSniffing' => 'X-Content-Type-Options: nosniff',
'referrerPolicy' => 'Referrer-Policy: strict-origin-when-cross-origin',
],
],
]
```
The options strictTransportSecurity, avoidMimeTypeSniffing
and referrerPolicy were added.> [!NOTE]
> The `Strict-Transport-Security` is only active, if the option
> [$GLOBALS\[TYPO3_CONF_VARS\]\[BE\]\[lockSSL\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-lockssl@12.4)
> is enabled.
- **passwordHashing**
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordHashing'\]
- **className**
- *Type:* string
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordHashing'\]\['className'\]
- *Default:* `\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2iPasswordHash::class`
Allowed values:
- **`\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2iPasswordHash::class`**
Good password hash mechanism. Used by default if available.
- **`\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class`**
Good password hash mechanism.
- **`\TYPO3\CMS\Core\Crypto\PasswordHashing\BcryptPasswordHash::class`**
Good password hash mechanism.
- **`\TYPO3\CMS\Core\Crypto\PasswordHashing\Pbkdf2PasswordHash::class`**
Fallback hash mechanism if argon and bcrypt are not available.
- **`\TYPO3\CMS\Core\Crypto\PasswordHashing\PhpassPasswordHash::class`**
Fallback hash mechanism if none of the above are available.
- **options**
- *Type:* array
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordHashing'\]\['options'\]
- *Default:* \[\]
Special settings for specific hashes.
See [Available hash algorithms](https://docs.typo3.org/permalink/t3coreapi:password-hashing-available-algorithms@12.4) for the different options
depending on the algorithm.
- **passwordPolicy**
- *Type:* string
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordPolicy'\]
- *Default:* default
Defines the [password policy](https://docs.typo3.org/permalink/t3coreapi:password-policies@12.4) in backend context.
- **stylesheets**
- *Type:* string
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['stylesheets'\]
- *Default:* default
Load additional CSS files for the TYPO3 backend interface. This setting
can be set per site or within an extension's [`ext_localconf.php`](../../ExtensionArchitecture/FileStructure/ExtLocalconf.md#file-extension-ext-localconf-php).
**Examples:**
Add a specific stylesheet:
```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']['my_extension']
= 'EXT:my_extension/Resources/Public/Css/myfile.css';
```
Add all stylesheets from a folder:
```php
$GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']['my_extension']
= 'EXT:my_extension/Resources/Public/Css/';
```
- **contentSecurityPolicyReportingUrl**
- *Type:* string
- *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['contentSecurityPolicyReportingUrl'\]
- *Default:* ''
Configure the reporting HTTP endpoint of
[Content Security Policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@12.4) violations in the
backend; if it is empty, the TYPO3 endpoint will be used.
Setting this configuration to `'0'` disables Content Security Policy
reporting. If the endpoint is still called then, the
server-side process responds with a 403 HTTP error message.
If defined, the [site-specific configuration](https://docs.typo3.org/permalink/t3coreapi:content-security-policy-site-endpoints@12.4)
in `config/sites/my_site/csp.yaml` takes precedence over the global configuration.
**config/system/additional.php**
```php
// Set a custom endpoint for Content Security Policy reporting
$GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl']
= 'https://csp-violation.example.org/';
```
**config/system/additional.php**
```php
// Disables Content Security Policy reporting
$GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl'] = '0';
```
Use [$GLOBALS\['TYPO3_CONF_VARS'\]\['FE'\]\['contentSecurityPolicyReportingUrl'\]](https://docs.typo3.org/permalink/t3coreapi:confval-typo3-conf-vars-fe-contentsecuritypolicyreportingurl@12.4)
to configure Content Security Policy reporting for the frontend.