BE - backend configuration

The following configuration variables can be used to configure settings for the TYPO3 backend:

fileadminDir
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir']
Default
'fileadmin/'

Path to the primary directory of files for editors. This is relative to the public web dir. DefaultStorage will be created with that configuration. Do not access manually but via \TYPO3\CMS\Core\Resource\ResourceFactory::getDefaultStorage().

lockRootPath
Type
array of file paths
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath']
Default
[]

Changed in version 11.5.35/12.4.11

This option has been extended to support an array of root path prefixes to allow for multiple storages to be listed (a string was expected before).

It is suggested to use the new array-based syntax, which will be applied automatically once this setting is updated via Install Tool configuration wizard. Migration:

config/system/settings.php 
// Before
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = '/var/extra-storage';

// After
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] =  [
    '/var/extra-storage1/',
    '/var/extra-storage2/',
];
Copied!

See also the security bulletin "Path Traversal in TYPO3 File Abstraction Layer Storages".

These absolute paths are used to evaluate, if paths outside of the project path should be allowed. This restriction also applies for the local driver of the File Abstraction Layer.

userHomePath
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['userHomePath']
Default
''

Combined folder identifier of the directory where TYPO3 backend users have their home-dirs. A combined folder identifier looks like this: [storageUid]:[folderIdentifier]. For Example 2:users/. A home for backend user 2 would be: 2:users/2/. Ending slash required!

groupHomePath
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['groupHomePath']
Default
''

Combined folder identifier of the directory where TYPO3 backend groups have their home-dirs. A combined folder identifier looks like this: [storageUid]:[folderIdentifier]. For example 2:groups/. A home for backend group 1 would be: 2:groups/1/. Ending slash required!

userUploadDir
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['userUploadDir']
Default
''

Suffix to the user home dir which is what gets mounted in TYPO3. For example if the user dir is ../123_user/ and this value is /upload then ../123_user/upload gets mounted.

warning_email_addr
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr']
Default
''

Email address that will receive notifications whenever an attempt to login to the Install Tool is made. This address will also receive warnings whenever more than 3 failed backend login attempts (regardless of user) are detected within an hour.

Have also a look into the security guidelines.

warning_mode
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_mode']
Default
0
Allowed values
1 0: Default: Do not send notification-emails upon backend-login 1: Send a notification-email every time a backend user logs in 2: Send a notification-email every time an admin backend user logs in

Send emails to warning_email_addr upon backend-login

Have also a look into the security guidelines.

passwordReset
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordReset']
Default
true

Enable password reset functionality on the backend login for TYPO3 Backend users. Can be disabled for systems where only LDAP or OAuth login is allowed.

Password reset will then still work on CLI and for admins in the backend.

passwordResetForAdmins
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordResetForAdmins']
Default
true

Enable password reset functionality for TYPO3 Administrators. This will affect all places such as backend login or CLI. Disable this option for increased security.

requireMfa
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa']
Default
0
Allowed values
0-4
0:
Default: Do not require multi-factor authentication
1:
Require multi-factor authentication for all users
2:
Require multi-factor authentication only for non-admin users
3:
Require multi-factor authentication only for admin users
4:
Require multi-factor authentication only for system maintainers

Define users which should be required to set up multi-factor authentication.

recommendedMfaProvider
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['recommendedMfaProvider']
Default
'totp'

Set the identifier of the multi-factor authentication provider, recommended for all users.

loginRateLimit
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimit']
Default
5

Maximum amount of login attempts for the time interval in [BE][loginRateLimitInterval], before further login requests will be denied. Setting this value to "0" will disable login rate limiting.

loginRateLimitInterval
Type
string, PHP relative format
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimitInterval']
Default
'15 minutes'
Allowed values
'1 minute', '5 minutes', '15 minutes', '30 minutes'

Allowed time interval for the configured rate limit. Individual values using PHP relative formats can be set in config/system/additional.php.

loginRateLimitIpExcludeList
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimitIpExcludeList']
Default
''

IP addresses (with *-wildcards) that are excluded from rate limiting. Syntax similar to [BE][IPmaskList]. An empty value disables the exclude list check.

lockIP
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockIP']
Default
0
Allowed values
0-4
0:
Default: Do not lock Backend User sessions to their IP address at all
1:
Use the first part of the editors IPv4 address (for example "192.") as part of the session locking of Backend Users
2:
Use the first two parts of the editors IPv4 address (for example "192.168") as part of the session locking of Backend Users
3:
Use the first three parts of the editors IPv4 address (for example "192.168.13") as part of the session locking of Backend Users
4:
Use the editors full IPv4 address (for example "192.168.13.84") as part of the session locking of Backend Users (highest security)

Session IP locking for backend users. See [FE][lockIP] for details.

Have also a look into the security guidelines.

lockIPv6
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockIPv6']
Default
0
Allowed values
0-8
0:
Default: Do not lock Backend User sessions to their IP address at all
1:
Use the first block (16 bits) of the editors IPv6 address (for example "2001:") as part of the session locking of Backend Users
2:
Use the first two blocks (32 bits) of the editors IPv6 address (for example "2001:0db8") as part of the session locking of Backend Users
3:
Use the first three blocks (48 bits) of the editors IPv6 address (for example "2001:0db8:85a3") as part of the session locking of Backend Users
4:
Use the first four blocks (64 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3") as part of the session locking of Backend Users
5:
Use the first five blocks (80 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319") as part of the session locking of Backend Users
6:
Use the first six blocks (96 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e") as part of the session locking of Backend Users
7:
Use the first seven blocks (112 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e:0370") as part of the session locking of Backend Users
8:
Use the editors full IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e:0370:7344") as part of the session locking of Backend Users (highest security)

Session IPv6 locking for backend users. See [FE][lockIPv6] for details.

sessionTimeout
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['sessionTimeout']
Default
28800

Session time out for backend users in seconds. The value must be at least 180 to avoid side effects. Default is 28.800 seconds = 8 hours.

IPmaskList
Type
list
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['IPmaskList']
Default
''

Lets you define a list of IP addresses (with *-wildcards) that are the ONLY ones allowed access to ANY backend activity. On error an error header is sent and the script exits. Works like IP masking for users configurable through TSconfig.

See syntax for that (or look up syntax for the function \TYPO3\CMS\Core\Utility\GeneralUtility::cmpIP())

Have also a look into the security guidelines.

lockSSL
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL']
Default
false

If set, the backend can only be operated from an SSL-encrypted connection (https). A redirect to the SSL version of a URL will happen when a user tries to access non-https admin-urls

Have also a look into the security guidelines.

lockSSLPort
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSLPort']
Default
0

Use a non-standard HTTPS port for lockSSL. Set this value if you use lockSSL and the HTTPS port of your webserver is not 443.

cookieDomain
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieDomain']
Default
''

Same as $TYPO3_CONF_VARS[SYS][cookieDomain]<typo3ConfVars_sys_cookieDomain> but only for BE cookies. If empty, $TYPO3_CONF_VARS[SYS][cookieDomain] value will be used.

cookieName
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieName']
Default
'be_typo_user'

Set the name for the cookie used for the back-end user session

cookieSameSite
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite']
Default
'strict'
Allowed values
'lax', 'strict', 'none'
lax:
Cookies set by TYPO3 are only available for the current site, third-party integrations are not allowed to read cookies, except for links and simple HTML forms
strict:
Cookies sent by TYPO3 are only available for the current site, never shared to other third-party packages
none:
Allow cookies set by TYPO3 to be sent to other sites as well, please note - this only works with HTTPS connections

Indicates that the cookie should send proper information where the cookie can be shared (first-party cookies vs. third-party cookies) in TYPO3 Backend.

showRefreshLoginPopup
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['showRefreshLoginPopup']
Default
false

If set, the Ajax relogin will show a real popup window for relogin after the count down. Some auth services need this as they add custom validation to the login form. If its not set, the Ajax relogin will show an inline relogin window.

adminOnly
Type
int
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['adminOnly']
Default
0
Allowed values

-1 - +2

-1:
Total shutdown for maintenance purposes
0:
Default: All users can access the TYPO3 Backend
1:
Only administrators / system maintainers can log in, CLI interface is disabled as well
2:
Only administrators / system maintainers have access to the TYPO3 Backend, CLI executions are allowed as well

Restricts access to the TYPO3 Backend - especially useful when doing maintenance or updates

disable_exec_function
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['disable_exec_function']
Default
false

Dont use exec() function (except for ImageMagick which is disabled by [GFX][im]<typo3ConfVars_gfx_im> =0). If set, all file operations are done by the default PHP-functions. This is necessary under Windows! On Unix the system commands by exec() can be used, unless this is disabled.

compressionLevel
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['compressionLevel']
Default
0
Range
0-9

Determines output compression of BE output. Makes output smaller but slows down the page generation depending on the compression level. Requires

  • zlib in your PHP installation and
  • special rewrite rules for .css.gz and .js.gz (before version 12.0 the extension was .css.gzip and .js.gzip)

Please see EXT:install/Resources/Private/FolderStructureTemplateFiles/root-htaccess for an example. Range 1-9, where 1 is least compression and 9 is greatest compression. true as value will set the compression based on the PHP default settings (usually 5 ). Suggested and most optimal value is 5.

installToolPassword
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword']
Default
''

The hash of the install tool password.

checkStoredRecords
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['checkStoredRecords']

Changed in version 13.0

This setting is obsolete. Instances setting this option in settings.php are updated silently by the install tool during the upgrade process to TYPO3 v13.

checkStoredRecordsLoose
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['checkStoredRecordsLoose']

Changed in version 13.0

This setting is obsolete. Instances setting this option in settings.php are updated silently by the install tool during the upgrade process to TYPO3 v13.

defaultUserTSconfig
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUserTSconfig']

Deprecated since version 13.0

defaultPageTSconfig
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPageTSconfig']

Deprecated since version 13.0

defaultPermissions
Type
array
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions']
Default
[]

This option defines the default page permissions (show, edit, delete, new, editcontent). The following order applies:

  • defaultPermissions from TYPO3\CMS\Core\DataHandling\PagePermissionAssembler
  • $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions'] (the option described here)
  • Page TSconfig via TCEMAIN.permissions

Example (which reflects the default permissions):

config/system/additional.php | typo3conf/system/additional.php 
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions'] = [
    'user' => 'show,edit,delete,new,editcontent',
    'group' => 'show,edit,new,editcontent',
    'everybody' => '',
];
Copied!

If you want to deviate from the default permissions, for example by changing the everybody key, you only need to modify the key you wish to change:

config/system/additional.php | typo3conf/system/additional.php 
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions'] = [
    'everybody' => 'show',
];
Copied!
defaultUC
Type
array
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUC']
Default
[]

Defines the default user settings. The following order applies:

  • uc_default in TYPO3\CMS\Core\Authentication\BackendUserAuthentication
  • $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUC'] (the option described here)
  • User TSconfig via setup

Example (which reflects the default user settings):

config/system/additional.php | typo3conf/system/additional.php 
$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUC'] = [
    'emailMeAtLogin' => 0,
    'titleLen' => 50,
    'edit_RTE' => '1',
    'edit_docModuleUpload' => '1',
];
Copied!

Visit the setup chapter of the User TSconfig guide for a list of all available options.

customPermOptions
Type
array
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['customPermOptions']
Default
[]

Array with sets of custom permission options. Syntax is:

config/system/additional.php | typo3conf/system/additional.php 
'key' => array(
    'header' => 'header string, language split',
    'items' => array(
       'key' => array('label, language split','icon reference', 'Description text, language split')
    )
)
Copied!

Keys cannot contain characters any of the following characters: :|,.

fileDenyPattern
Type
text
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern']
Default
''

A perl-compatible and JavaScript-compatible regular expression (without delimiters /) that - if it matches a filename - will deny the file upload/rename or whatever.

For security reasons, files with multiple extensions have to be denied on an Apache environment with mod_alias, if the filename contains a valid php handler in an arbitrary position. Also, ".htaccess" files have to be denied. Matching is done case-insensitive.

Default value is stored in class constant \TYPO3\CMS\Core\Resource\Security\FileNameValidator::FILE_DENY_PATTERN_DEFAULT.

Have also a look into the security guidelines.

flexformForceCDATA
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['flexformForceCDATA']

Changed in version 13.0

This option was removed with TYPO3 v13.0.

versionNumberInFilename
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['versionNumberInFilename']
Default
false

If enabled, included CSS and JS files loaded in the TYPO3 Backend will have the timestamp embedded in the filename, ie. filename.1269312081.js . This will make browsers and proxies reload the files if they change (thus avoiding caching issues).

IMPORTANT: This feature requires extra .htaccess rules to work (please refer to the typo3/sysext/install/Resources/Private/FolderStructureTemplateFiles/root-htaccess file shipped with TYPO3).

If disabled the last modification date of the file will be appended as a query-string.

debug
Type
bool
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['debug']
Default
false

If enabled, the login refresh is disabled and pageRenderer is set to debug mode. Furthermore the fieldname is appended to the label of fields. Use this to debug the backend only!

HTTP
Type
array
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['HTTP']

Set HTTP headers to be sent with each backend request. Other keys than ['Response']['Headers'] are ignored.

The default configuration:

[
    'Response' => [
        'Headers' => [
            'clickJackingProtection' => 'X-Frame-Options: SAMEORIGIN',
            'strictTransportSecurity' => 'Strict-Transport-Security: max-age=31536000',
            'avoidMimeTypeSniffing' => 'X-Content-Type-Options: nosniff',
            'referrerPolicy' => 'Referrer-Policy: strict-origin-when-cross-origin',
        ],
    ],
]
Copied!
passwordHashing
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']
className
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['className']
Default
\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2iPasswordHash::class

Allowed values:

\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2iPasswordHash::class
Good password hash mechanism. Used by default if available.
\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class
Good password hash mechanism.
\TYPO3\CMS\Core\Crypto\PasswordHashing\BcryptPasswordHash::class
Good password hash mechanism.
\TYPO3\CMS\Core\Crypto\PasswordHashing\Pbkdf2PasswordHash::class
Fallback hash mechanism if argon and bcrypt are not available.
\TYPO3\CMS\Core\Crypto\PasswordHashing\PhpassPasswordHash::class
Fallback hash mechanism if none of the above are available.
options
Type
array
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['options']
Default
[]

Special settings for specific hashes. See Available hash algorithms for the different options depending on the algorithm.

passwordPolicy
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy']
Default
default

Defines the password policy in backend context.

stylesheets
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']
Default
default

Load additional CSS files for the TYPO3 backend interface. This setting can be set per site or within an extension's ext_localconf.php.

Examples:

Add a specific stylesheet:

$GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']['my_extension']
    = 'EXT:my_extension/Resources/Public/Css/myfile.css';
Copied!

Add all stylesheets from a folder:

$GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']['my_extension']
    = 'EXT:my_extension/Resources/Public/Css/';
Copied!
contentSecurityPolicyReportingUrl
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl']
Default
''

Configure the reporting HTTP endpoint of Content Security Policy violations in the backend; if it is empty, the TYPO3 endpoint will be used.

Example:

$GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl']
    = 'https://csp-violation.example.org/';
Copied!
entryPoint
Type
string
Path
$GLOBALS['TYPO3_CONF_VARS']['BE']['entryPoint']
Default
'/typo3'

New in version 13.0

A custom backend entry point can be configured by specifying a custom URL path or domain name.

Example:
$GLOBALS['TYPO3_CONF_VARS']['BE']['entryPoint'] = '/my-specific-path';
Copied!