---
title: "Configuration"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:configuration@main"
source: "Configuration/Index.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# Configuration {#configuration}

The policy is configured exclusively in
`$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['nr_http_guard']`.
It is loaded as an immutable snapshot. Changes to
`HTTP.allowed_hosts` or Vault's legacy host lists do not
create an HTTP Guard endpoint permission.

Add the examples to the project configuration, for example
[`config/system/additional.php`](https://docs.typo3.org/m/typo3/reference-coreapi/14.3/en-us/Configuration/Typo3ConfVars/Index.html#file-project-config-system-additional-php) or, in a matching classic project
layout, `typo3conf/AdditionalConfiguration.php`. HTTP Guard does
not provide a backend editor for security permissions.

## Internal endpoint example {#configuration-example}

Replace the example host and address with the approved production
integration. The profile applies only to a client that trusted service
wiring binds to `erp-orders`.

**Project configuration for a bound ERP client**

```php
<?php

declare (strict_types=1);
// Replace this synthetic endpoint with the approved production origin and address.
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['nr_http_guard'] = [
    'schemaVersion' => 1,
    'mode' => 'enforce',
    'resolver' => ['staticHosts' => ['erp.internal.example' => ['10.23.4.12']]],
    'tls' => ['requireVerification' => true],
    'endpoints' => [
        'erp-orders' => [
            'origin' => 'https://erp.internal.example:8443',
            'allowedCidrs' => ['10.23.4.12/32'],
            'methods' => ['GET', 'POST'],
            'redirects' => 'none',
            'allowLoopback' => false,
            'purpose' => 'Bestellabgleich mit dem internen ERP',
            'owner' => 'ERP-Team',
            'reviewAfter' => '2027-01-15',
            'expiresAt' => '2027-04-01T00:00:00Z',
        ],
    ],
];

```

Static resolution is optional. Without it, the controlled DNS resolver
is used. Every resolved address must match the permitted network. A
valid public candidate alongside a forbidden private candidate does
not make the response acceptable.

## Schema and validation {#configuration-schema}

Unknown fields, incorrect types, invalid origins and invalid CIDRs
produce `configuration_invalid`. Strings such as
`"5"` or `"true"` do not substitute for integers or
booleans. `CONNECT` is forbidden as an endpoint method.
Profile IDs contain at most 64 ASCII characters: letters, digits,
dots, underscores and hyphens, starting with a letter or digit.

The normalized policy and the SHA-256 hash of the supplied address rules
determine the revision. Equivalent forms are normalized. Changing the
rule file produces a different revision. To use a new revision,
recreate the registry, engine and clients. This does not automatically
revoke clients in existing workers.

-   [General options](https://docs.typo3.org/permalink/netresearch/nr-http-guard:general-options@main)
-   [Endpoint profiles](https://docs.typo3.org/permalink/netresearch/nr-http-guard:endpoint-profiles@main)