--- title: "BE - backend configuration" manual: "TYPO3 Explained" version: "main" permalink: "https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be@main" source: "Configuration/Typo3ConfVars/BE.rst" rendered: "2026-09-22T15:26:06+00:00" --- # BE - backend configuration {#typo3confvars-be} The following configuration variables can be used to configure the TYPO3 backend: > [!NOTE] > The configuration values listed here are keys in the > `$GLOBALS['TYPO3_CONF_VARS']['BE']` global PHP array. > > This variable can be set in one of the following files: > > - [config/system/settings.php](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-settings@main) > - [config/system/additional.php](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-additional@main) ## fileadminDir {#typo3confvars-be-fileadmindir} - **fileadminDir** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['fileadminDir'\] - *Default:* 'fileadmin/' Path to the main file directory for editors. This is relative to the public web directory. DefaultStorage will be created with this configuration. Do not access manually but via `\TYPO3\CMS\Core\Resource\StorageRepository::getDefaultStorage()`. ## lockBackendFile {#typo3confvars-be-lockbackendfile} - **lockBackendFile** - *Type:* string (file path) - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockBackendFile'\] - *Default:* `"var/lock/LOCK_BACKEND"` (Composer mode) | `"config/LOCK_BACKEND"` (Classic mode) Defines the location of the flag file [`LOCK_BACKEND`](../../Administration/DirectoryStructure/FlagFiles.md#file-var-lock-lock-backend). The file temporarily restricts backend access to prevent unauthorized changes or during critical updates. ## lockRootPath {#typo3confvars-be-lockrootpath} - **lockRootPath** - *Type:* array of file paths - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockRootPath'\] - *Default:* `[]` These absolute paths are used to check if paths outside of the project path should be allowed. This restriction also applies to the local driver in the [File Abstraction Layer](https://docs.typo3.org/permalink/t3coreapi:fal@main). This option supports an array of root path prefixes to allow multiple storage locations to be listed. See also the [Security bulletin "Path Traversal in TYPO3 File Abstraction Layer Storages"](https://typo3.org/security/advisory/typo3-core-sa-2024-001). > [!WARNING] > **Attention** > > Trailing slashes are enforced automatically. ## userHomePath {#typo3confvars-be-userhomepath} - **userHomePath** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['userHomePath'\] - *Default:* '' Combined folder identifier pointing to the directory where TYPO3 backend users have their home-dirs. A combined folder identifier looks like this: `[storageUid]:[folderIdentifier]`, for example, `2:users/`. The home directory identifier of backend user 2 would be: `2:users/2/`. End slash required! ## groupHomePath {#typo3confvars-be-grouphomepath} - **groupHomePath** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['groupHomePath'\] - *Default:* '' Combined folder identifier pointing to the directory where TYPO3 backend groups have their home-dirs. A combined folder identifier looks like this: `[storageUid]:[folderIdentifier]`, for example, `2:groups/`. The home directory identifier of backend group 1 would be: `2:groups/1/`. End slash required! ## userUploadDir {#typo3confvars-be-useruploaddir} - **userUploadDir** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['userUploadDir'\] - *Default:* '' Suffix which as added to the user home dir path when mounted in TYPO3. For example, if the user dir is `../123_user/` and the suffix is `/upload` then `../123_user/upload` will be mounted. ## warning_email_addr {#typo3confvars-be-warning-email-addr} - **warning_email_addr** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['warning_email_addr'\] - *Default:* '' Email address that will receive notifications whenever there is an attempt to login to the Install Tool. This address will also receive warnings when more than 3 failed backend login attempts are detected within an hour (regardless of user). See also [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-warning-email-addr@main). ## warning_mode {#typo3confvars-be-warning-mode} - **warning_mode** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['warning_mode'\] - *Default:* 0 - *Allowed values:* 1 0: Default: Do not send notification-emails upon backend-login 1: Send a notification-email every time a backend user logs in 2: Send a notification-email every time an **admin** backend user logs in Send emails to `warning_email_addr` upon backend-login. See also [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-warning-mode@main). ## passwordReset {#typo3confvars-be-passwordreset} - **passwordReset** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordReset'\] - *Default:* true Enable password reset in the backend login for TYPO3 Backend users. Can be disabled for systems where only LDAP or OAuth login is allowed. Password reset will still work via CLI and for admins in the backend. ## passwordResetForAdmins {#typo3confvars-be-passwordresetforadmins} - **passwordResetForAdmins** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordResetForAdmins'\] - *Default:* true Enable password reset for TYPO3 Administrators. This will affect both backend login and CLI. Disable this option for increased security. ## requireMfa {#typo3confvars-be-requiremfa} - **requireMfa** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['requireMfa'\] - *Default:* 0 - *Allowed values:* 0-4 - **0:** Default: Do not require multi-factor authentication - **1:** Require multi-factor authentication for all users - **2:** Require multi-factor authentication only for non-admin users - **3:** Require multi-factor authentication only for admin users - **4:** Require multi-factor authentication only for system maintainers Define users that should be required to set up [multi-factor authentication](https://docs.typo3.org/permalink/t3coreapi:multi-factor-authentication@main). ## recommendedMfaProvider {#typo3confvars-be-recommendedmfaprovider} - **recommendedMfaProvider** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['recommendedMfaProvider'\] - *Default:* 'totp' Set the identifier of the [multi-factor authentication provider](https://docs.typo3.org/permalink/t3coreapi:multi-factor-authentication-included-providers@main). Recommended for all users. ## loginRateLimit {#typo3confvars-be-loginratelimit} - **loginRateLimit** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['loginRateLimit'\] - *Default:* 5 Maximum amount of login attempts in time interval [\[BE\]\[loginRateLimitInterval\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-loginratelimitinterval@main) before further login requests will be denied. Setting this value to `"0"` will disable login rate limiting. ## loginRateLimitInterval {#typo3confvars-be-loginratelimitinterval} - **loginRateLimitInterval** - *Type:* string, PHP relative format - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['loginRateLimitInterval'\] - *Default:* '15 minutes' - *Allowed values:* '1 minute', '5 minutes', '15 minutes', '30 minutes' Time interval for the configured rate limit. Individual values using [PHP relative formats](https://www.php.net/manual/de/datetime.formats.relative.php) can be set in `config/system/additional.php`. ## loginRateLimitIpExcludeList {#typo3confvars-be-loginratelimitipexcludelist} - **loginRateLimitIpExcludeList** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['loginRateLimitIpExcludeList'\] - *Default:* '' IP addresses (with `*`-wildcards) that are excluded from rate limiting. Syntax similar to [\[BE\]\[IPmaskList\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-ipmasklist@main). An empty value disables the exclude list check. ## lockIP {#typo3confvars-be-lockip} - **lockIP** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockIP'\] - *Default:* 0 - *Allowed values:* 0-4 - **0:** Default: Do not lock Backend User sessions to their IP address - **1:** Use the first part of the editors IPv4 address (for example "192.") as part of the session locking of Backend Users - **2:** Use the first two parts of the editors IPv4 address (for example "192.168") as part of the session locking of Backend Users - **3:** Use the first three parts of the editors IPv4 address (for example "192.168.13") as part of the session locking of Backend Users - **4:** Use the editors full IPv4 address (for example "192.168.13.84") as part of the session locking of Backend Users (highest security) Session IP locking for backend users. See [\[FE\]\[lockIP\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-fe-lockip@main) for details. See also [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-lockip@main). ## lockIPv6 {#typo3confvars-be-lockipv6} - **lockIPv6** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockIPv6'\] - *Default:* 0 - *Allowed values:* 0-8 - **0:** Default: Do not lock Backend User sessions to their IP address - **1:** Use the first block (16 bits) of the editors IPv6 address (for example "2001:") as part of the session locking of Backend Users - **2:** Use the first two blocks (32 bits) of the editors IPv6 address (for example "2001:0db8") as part of the session locking of Backend Users - **3:** Use the first three blocks (48 bits) of the editors IPv6 address (for example "2001:0db8:85a3") as part of the session locking of Backend Users - **4:** Use the first four blocks (64 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3") as part of the session locking of Backend Users - **5:** Use the first five blocks (80 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319") as part of the session locking of Backend Users - **6:** Use the first six blocks (96 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e") as part of the session locking of Backend Users - **7:** Use the first seven blocks (112 bits) of the editors IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e:0370") as part of the session locking of Backend Users - **8:** Use the editors full IPv6 address (for example "2001:0db8:85a3:08d3:1319:8a2e:0370:7344") as part of the session locking of Backend Users (highest security) Session IPv6 locking for backend users. See [\[FE\]\[lockIPv6\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-fe-lockipv6@main) for details. ## sessionTimeout {#typo3confvars-be-sessiontimeout} - **sessionTimeout** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['sessionTimeout'\] - *Default:* 28800 Session timeout for backend users (in seconds). The value must be at least 180 to avoid side effects. The default is 28800 seconds = 8 hours. ## IPmaskList {#typo3confvars-be-ipmasklist} - **IPmaskList** - *Type:* list - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['IPmaskList'\] - *Default:* '' Lets you define a list of IP addresses (with \*-wildcards) that are the ONLY IP addresses that are allowed access to ANY backend activity. On error, an error header is sent and the script exits. Works like IP masking for users configurable through TSconfig. See syntax for that (or look up syntax for the function `\TYPO3\CMS\Core\Utility\GeneralUtility::cmpIP())` See also [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-ipmasklist@main). ## lockSSL {#typo3confvars-be-lockssl} - **lockSSL** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockSSL'\] - *Default:* false If set, the backend can only be accessed via an SSL-encrypted connection (https). If a user tries to access non-https admin-urls, they will be redirected to the SSL version of the URL. See also [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-lockssl@main). ## lockSSLPort {#typo3confvars-be-locksslport} - **lockSSLPort** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['lockSSLPort'\] - *Default:* 0 Use a non-standard HTTPS port for lockSSL. Set this value if you use lockSSL and the HTTPS port of your webserver is not 443. ## cookieDomain {#typo3confvars-be-cookiedomain} - **cookieDomain** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['cookieDomain'\] - *Default:* '' Same as [$TYPO3_CONF_VARS\[SYS\]\[cookieDomain\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-cookiedomain@main) but for BE cookies. If empty, the `$TYPO3_CONF_VARS[SYS][cookieDomain]` value will be used. ## cookieName {#typo3confvars-be-cookiename} - **cookieName** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['cookieName'\] - *Default:* 'be_typo_user' Set the cookie name for the back-end user session. ## cookieSameSite {#typo3confvars-be-cookiesamesite} - **cookieSameSite** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['cookieSameSite'\] - *Default:* 'strict' - *Allowed values:* 'lax', 'strict', 'none' - **lax:** Cookies set by TYPO3 are only available for the current site. Third-party integrations are not allowed to read cookies, except for links and simple HTML forms - **strict:** Cookies set by TYPO3 are only available for the current site. They are never shared with third-party packages - **none:** Allow cookies set by TYPO3 to be sent to other sites as well. Note: this only works with HTTPS connections Configures how cookies can be shared in the TYPO3 Backend (first-party cookies vs. third-party cookies) ## showRefreshLoginPopup {#typo3confvars-be-showrefreshloginpopup} - **showRefreshLoginPopup** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['showRefreshLoginPopup'\] - *Default:* false If set, the Ajax relogin will show a popup window for relogin after a countdown. Some authorization services need this as they add custom validation to the login form. If it is not set, the Ajax relogin will show an inline relogin window. ## adminOnly {#typo3confvars-be-adminonly} - **adminOnly** - *Type:* int - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['adminOnly'\] - *Default:* 0 - *Allowed values:* -1 - +2 - **-1:** Total shutdown for maintenance purposes - **0:** Default: All users can access the TYPO3 Backend - **1:** Only administrators / system maintainers can log in and CLI interface is disabled - **2:** Only administrators / system maintainers have access to the TYPO3 Backend. CLI executions are allowed Restricts access to the TYPO3 Backend. Useful when doing maintenance or updates ## disable_exec_function {#typo3confvars-be-disable-exec-function} - **disable_exec_function** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['disable_exec_function'\] - *Default:* false Don't use exec() function (except for ImageMagick which is disabled by [\[GFX\]\[processor_enabled\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-gfx-processor-enabled@main) = false). If set, all file operations are done by the default PHP functions. This is necessary under Windows! On Unix system commands using exec() can be used, unless this is disabled. ## compressionLevel {#typo3confvars-be-compressionlevel} - **compressionLevel** - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['compressionLevel'\] Backend HTTP response compression has been removed. Response compression should be applied by web servers and not by the application layer.See also: Breaking: #107943 - Frontend and backend HTTP response compression removed ## installToolPassword {#typo3confvars-be-installtoolpassword} - **installToolPassword** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['installToolPassword'\] - *Default:* '' Hash of the install tool password. See also [Enabling and accessing the Install Tool](https://docs.typo3.org/permalink/t3coreapi:security-install-tool-access@main). You can also use the command vendor/bin/typo3 install:password:set to change the install tool password. ## defaultPermissions {#typo3confvars-be-defaultpermissions} - **defaultPermissions** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['defaultPermissions'\] - *Default:* \[\] This option defines the default page permissions (`show`, `edit`, `delete`, `new`, `editcontent`). The following order applies: - `defaultPermissions` from `\TYPO3\CMS\Core\DataHandling\PagePermissionAssembler` - `$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions']` (the option described here) - Page TSconfig via [TCEMAIN.permissions](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/PageTsconfig/TceMain.html#pagetcemain-permissions-user-group) Example (with default permissions): **config/system/additional.php | typo3conf/system/additional.php** ```php 'show,edit,delete,new,editcontent', 'group' => 'show,edit,new,editcontent', 'everybody' => '', ]; ``` If you want to deviate from the default permissions, for example, by changing the 'everybody' key, just modify that key: **config/system/additional.php | typo3conf/system/additional.php** ```php $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPermissions'] = [ 'everybody' => 'show', ]; ``` ## defaultUC {#typo3confvars-be-defaultuc} - **defaultUC** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['defaultUC'\] - *Default:* \[\] Defines default user settings. The following order applies: - `uc_default` in `\TYPO3\CMS\Core\Authentication\BackendUserAuthentication` - `$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUC']` (the option described here) - User TSconfig via [setup](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Setup.html#usersetup) Example (with default user settings): **config/system/additional.php | typo3conf/system/additional.php** ```php 0, 'titleLen' => 50, 'edit_RTE' => '1', 'edit_docModuleUpload' => '1', ]; ``` Visit the [setup](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Setup.html#usersetup) chapter of the User TSconfig guide for a list of available options. ## customPermOptions {#typo3confvars-be-custompermoptions} - **customPermOptions** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['customPermOptions'\] - *Default:* \[\] Array with sets of custom permission options. The syntax is: **config/system/additional.php | typo3conf/system/additional.php** ```php [ 'header' => 'header string, language split', 'items' => [ 'key' => [ 'label, language split', 'icon reference', 'Description text, language split', ], ], ], ]; ``` Keys cannot contain any of the following characters: `:|,`. ## fileDenyPattern {#typo3confvars-be-filedenypattern} - **fileDenyPattern** - *Type:* text - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['fileDenyPattern'\] - *Default:* '' A perl and JavaScript-compatible regular expression that will block ('deny') operations on files with matching filenames (without delimiters `/`), for example, file upload, rename, etc. For security reasons, files with multiple extensions in an Apache environment must be blocked using mod_alias, if the filename contains a valid php handler in an arbitrary position. Also, ".htaccess" files must be blocked. Matching is case-insensitive. The default value is stored in class constant `\TYPO3\CMS\Core\Resource\Security\FileNameValidator::FILE_DENY_PATTERN_DEFAULT`. See also [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-filedenypattern@main). ## versionNumberInFilename {#typo3confvars-be-versionnumberinfilename} - **versionNumberInFilename** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['versionNumberInFilename'\] - *Default:* false If enabled, CSS and JS files loaded in the TYPO3 Backend will have a timestamp in their filename, i.e. `filename.1269312081.js` . This will force browsers and proxies to reload the files if they change (thus avoiding caching issues). **IMPORTANT:** This feature requires extra `.htaccess` rules in order to work (please refer to the `typo3/sysext/install/Resources/Private/FolderStructureTemplateFiles/root-htaccess` file shipped with TYPO3). If disabled, the last modification date of the file will be appended as a query-string. ## debug {#typo3confvars-be-debug} - **debug** - *Type:* bool - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['debug'\] - *Default:* false If enabled, login refresh is disabled and pageRenderer is set to debug mode. Also, fieldnames are appended to field labels. Use this to debug the backend only! ## HTTP {#typo3confvars-be-http} - **HTTP** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['HTTP'\] Set HTTP headers to be sent with each backend request. Keys other than `['Response']['Headers']` are ignored. Default configuration: **Default value of $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['HTTP'\]** ```php [ 'Response' => [ 'Headers' => [ 'clickJackingProtection' => 'X-Frame-Options: SAMEORIGIN', 'strictTransportSecurity' => 'Strict-Transport-Security: max-age=31536000', 'avoidMimeTypeSniffing' => 'X-Content-Type-Options: nosniff', 'referrerPolicy' => 'Referrer-Policy: strict-origin-when-cross-origin', ], ], ] ``` > [!NOTE] > `Strict-Transport-Security` is only active if the option > [$GLOBALS\[TYPO3_CONF_VARS\]\[BE\]\[lockSSL\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-lockssl@main) > is enabled. ## passwordHashing {#globals-typo3-conf-vars-be-passwordhashing} - **passwordHashing** - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordHashing'\] - **className** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordHashing'\]\['className'\] - *Default:* `\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2iPasswordHash::class` Allowed values: - **`\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2iPasswordHash::class`** Good password hash mechanism. Used by default if available. - **`\TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class`** Good password hash mechanism. - **`\TYPO3\CMS\Core\Crypto\PasswordHashing\BcryptPasswordHash::class`** Good password hash mechanism. - **`\TYPO3\CMS\Core\Crypto\PasswordHashing\Pbkdf2PasswordHash::class`** Fallback hash mechanism if argon and bcrypt are not available. - **`\TYPO3\CMS\Core\Crypto\PasswordHashing\PhpassPasswordHash::class`** Fallback hash mechanism if none of the above are available. - **options** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordHashing'\]\['options'\] - *Default:* \[\] Special settings for specific hash algorithms. See [Available hash algorithms](https://docs.typo3.org/permalink/t3coreapi:password-hashing-available-algorithms@main) for the different options. ## passwordPolicy {#typo3confvars-be-passwordpolicy} - **passwordPolicy** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['passwordPolicy'\] - *Default:* default Defines the [password policy](https://docs.typo3.org/permalink/t3coreapi:password-policies@main) in the backend context. ## stylesheets {#typo3confvars-be-stylesheets} - **stylesheets** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['stylesheets'\] - *Default:* default Load additional CSS files for the TYPO3 backend interface. This can be set for a site or in an extension [`ext_localconf.php`](../../ExtensionArchitecture/FileStructure/ExtLocalconf.md#file-extension-ext-localconf-php) file. **Examples:** Add a specific stylesheet: ```php $GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']['my_extension'] = 'EXT:my_extension/Resources/Public/Css/myfile.css'; ``` Add all stylesheets from a folder: ```php $GLOBALS['TYPO3_CONF_VARS']['BE']['stylesheets']['my_extension'] = 'EXT:my_extension/Resources/Public/Css/'; ``` ## contentSecurityPolicyReportingUrl {#typo3confvars-be-contentsecuritypolicyreportingurl} - **contentSecurityPolicyReportingUrl** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['contentSecurityPolicyReportingUrl'\] - *Default:* '' Configure the reporting HTTP endpoint of [Content Security Policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@main) violations in the backend; if it is empty, the TYPO3 endpoint will be used. Setting this configuration to `'0'` disables Content Security Policy reporting. If the endpoint is still called, the server-side process responds with a 403 HTTP error message. If defined, [site-specific configuration](https://docs.typo3.org/permalink/t3coreapi:content-security-policy-site-endpoints@main) in [`config/sites/my_site/csp.yaml`](../../Administration/DirectoryStructure/SiteFolder.md#file-site-config-sites-my-site-csp-yaml) takes precedence over the global configuration. **config/system/additional.php** ```php // Set a custom endpoint for Content Security Policy reporting $GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl'] = 'https://csp-violation.example.org/'; ``` **config/system/additional.php** ```php // Disables Content Security Policy reporting $GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl'] = '0'; ``` Use [$GLOBALS\['TYPO3_CONF_VARS'\]\['FE'\]\['contentSecurityPolicyReportingUrl'\]](https://docs.typo3.org/permalink/t3coreapi:confval-typo3-conf-vars-fe-contentsecuritypolicyreportingurl@main) to configure Content Security Policy reporting for the frontend. ## entryPoint {#typo3confvars-be-entrypoint} - **entryPoint** - *Type:* string - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['entryPoint'\] - *Default:* '/typo3' A custom backend entry point can be configured by specifying a custom URL path or domain name. **Example:** ```php $GLOBALS['TYPO3_CONF_VARS']['BE']['entryPoint'] = '/my-specific-path'; ``` > [!NOTE] > **See also** > > [Backend entry point](https://docs.typo3.org/permalink/t3coreapi:backend-entry-point@main) ## installToolSessionHandler {#globals-typo3-conf-vars-be-installtoolsessionhandler} - **installToolSessionHandler** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['installToolSessionHandler'\] - **className** - *Type:* fully qualified class name (implements `\SessionHandlerInterface`) - *Default:* `\TYPO3\CMS\Install\Service\Session\FileSessionHandler` - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['installToolSessionHandler'\]\['className'\] Store Install Tool sessions in Redis by setting `className` to `\TYPO3\CMS\Install\Service\Session\RedisSessionHandler` Custom session handlers can be implemented using the PHP `\SessionHandlerInterface`. - **options** - *Type:* array - *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['installToolSessionHandler'\]\['options'\] For the `FileSessionHandler` you can configure the `sessionPath`. **File-based session handler in config/system/settings.php** ```php [ 'installToolSessionHandler' => [ 'className' => FileSessionHandler::class, 'options' => [ 'sessionPath' => Environment::getVarPath() . '/session', ], ], ], ]; ``` For the `RedisSessionHandler` you can configure `host`, `port`, `database` and `authentification`: **Redis session handler in config/system/settings.php** ```php [ 'installToolSessionHandler' => [ 'className' => RedisSessionHandler::class, 'options' => [ 'host' => '127.0.0.1', 'port' => 6379, 'database' => 0, 'authentication' => [ 'user' => 'redis', 'pass' => 'redis', ], ], ], ], ]; ```