---
title: "Backend user object"
manual: "TYPO3 Explained"
version: "13.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:be-user@13.4"
source: "ApiOverview/Backend/BackendUserObject.rst"
rendered: "2026-09-21T07:21:01+00:00"
---

# Backend user object {#be-user}

The backend user of a session is always available in extensions
as the global variable `$GLOBALS['BE_USER']`. The object is created in
`\TYPO3\CMS\Backend\Middleware\BackendUserAuthenticator` middleware for a standard web request
and is an instance of the class `\TYPO3\CMS\Core\Authentication\BackendUserAuthentication`
(which extends `\TYPO3\CMS\Core\Authentication\AbstractUserAuthentication`).

When working with CLI and commands you might initialize the backend user object with `\TYPO3\CMS\Core\Core\Bootstrap::initializeBackendUser()`. In addition, you can call `\TYPO3\CMS\Core\Core\Bootstrap::initializeBackendAuthentication()` to load the language of the CLI user set in the backend so that view helpers (like `f:translate()`) used in the CLI resolve to the correct language.

## Checking user access {#be-user-check}

The `$GLOBALS['BE_USER']` object is mostly used to check user access right,
but contains other helpful information. This is presented here by a few examples:

## Checking access to any backend module {#be-user-access-any}

If you know the module key you can check if the module is included in
the access list by this function call:

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->check('modules', 'web_list');
```

Here access to the module **Web > List** is checked.

## Access to tables and fields? {#be-user-access-tables}

The same function `->check()` can actually check all the group-based permissions
inside `$GLOBALS['BE_USER']`. For instance:

Checking modify access to the table "pages":

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->check('tables_modify', 'pages');
```

Checking read access to the table "tt_content":

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->check('tables_select', 'tt_content');
```

Checking if a table/field pair is allowed explicitly through the
"Allowed Excludefields":

**EXT:some_extension/Classes/Controller/SomeController.php**

```php
$GLOBALS['BE_USER']->check('non_exclude_fields', $table . ':' . $field);
```

## Is "admin"? {#be-user-admin}

If you want to know if a user is an "admin" user (has complete
access), just call this method:

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->isAdmin();
```

## Read access to a page? {#be-user-page}

This function call will return true if the user has read access to a
page (represented by its database record, `$pageRec`):

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->doesUserHaveAccess($pageRec, 1);
```

Changing the "1" for other values will check other permissions:

-   use "2" for checking if the user may edit the page
-   use "4" for checking if the user may delete the page.

## Is a page inside a DB mount? {#be-user-mount}

Access to a page should not be checked only based on page permissions
but also if a page is found within a DB mount for ther user. This can
be checked by this function call (`$id` is the page uid):

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->isInWebMount($id)
```

## Selecting readable pages from database? {#be-user-pageperms}

If you wish to make a SQL statement which selects pages from the
database and you want it to be only pages that the user has read
access to, you can have a proper WHERE clause returned by this
function call:

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->getPagePermsClause(1);
```

Again the number "1" represents the "read" permission; "2" is "edit"
and "4" is "delete" permission. The result from the above query could be this string:

**Result of the above query**

```none
((pages.perms_everybody & 1 = 1)OR(pages.perms_userid = 2 AND pages.perms_user & 1 = 1)OR(pages.perms_groupid in (1) AND pages.perms_group & 1 = 1))
```

## Saving module data {#be-user-module-save}

This stores the input variable `$compareFlags` (an array!, retrieved from
the [request object](https://docs.typo3.org/permalink/t3coreapi:typo3-request@13.4)) with the key
"tools_beuser/index.php/compare":

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$compareFlags = $request->getParsedBody()['compareFlags'])
    ?? $request->getQueryParams()['compareFlags'])
    ?? null;
$GLOBALS['BE_USER']->pushModuleData('tools_beuser/index.php/compare', $compareFlags);
```

## Getting module data {#be-user-module-get}

This gets the module data with the key
"tools_beuser/index.php/compare" (lasting only for the session) :

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$compareFlags = $GLOBALS['BE_USER']->getModuleData('tools_beuser/index.php/compare', 'ses');
```

## Getting TSconfig {#be-user-tsconfig}

This function can return a value from the "user TSconfig" structure of
the user. In this case the value for "options.clipboardNumberPads":

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$tsconfig = $GLOBALS['BE_USER']->getTSConfig();
$clipboardNumberPads = $tsconfig['options.']['clipboardNumberPads'] ?? '';
```

## Getting the Username {#be-user-name}

The full "be_users" record of a authenticated user is available in
`$GLOBALS['BE_USER']`->user as an array. This will return the "username":

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->user['username']
```

## Get User Configuration Value {#be-user-configuration}

The internal `->uc` array contains options which are managed by the
User Tools > **User Settings** module (extension "setup"). These values are accessible in
the `$GLOBALS['BE_USER']->uc` array. This will return the current state of
"Notify me by email, when somebody logs in from my account" for the user:

**EXT:some_extension/Classes/Controller/SomeModuleController.php**

```php
$GLOBALS['BE_USER']->uc['emailMeAtLogin']
```