Configuration

The policy is configured exclusively in $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['nr_http_guard']. It is loaded as an immutable snapshot. Changes to HTTP.allowed_hosts or Vault's legacy host lists do not create an HTTP Guard endpoint permission.

Add the examples to the project configuration, for example config/system/additional.php or, in a matching classic project layout, typo3conf/AdditionalConfiguration.php. HTTP Guard does not provide a backend editor for security permissions.

Internal endpoint example

Replace the example host and address with the approved production integration. The profile applies only to a client that trusted service wiring binds to erp-orders.

Project configuration for a bound ERP client

<?php

declare (strict_types=1);
// Replace this synthetic endpoint with the approved production origin and address.
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['nr_http_guard'] = [
    'schemaVersion' => 1,
    'mode' => 'enforce',
    'resolver' => ['staticHosts' => ['erp.internal.example' => ['10.23.4.12']]],
    'tls' => ['requireVerification' => true],
    'endpoints' => [
        'erp-orders' => [
            'origin' => 'https://erp.internal.example:8443',
            'allowedCidrs' => ['10.23.4.12/32'],
            'methods' => ['GET', 'POST'],
            'redirects' => 'none',
            'allowLoopback' => false,
            'purpose' => 'Bestellabgleich mit dem internen ERP',
            'owner' => 'ERP-Team',
            'reviewAfter' => '2027-01-15',
            'expiresAt' => '2027-04-01T00:00:00Z',
        ],
    ],
];

Static resolution is optional. Without it, the controlled DNS resolver is used. Every resolved address must match the permitted network. A valid public candidate alongside a forbidden private candidate does not make the response acceptable.

Schema and validation

Unknown fields, incorrect types, invalid origins and invalid CIDRs produce configuration_invalid. Strings such as "5" or "true" do not substitute for integers or booleans. CONNECT is forbidden as an endpoint method. Profile IDs contain at most 64 ASCII characters: letters, digits, dots, underscores and hyphens, starting with a letter or digit.

The normalized policy and the SHA-256 hash of the supplied address rules determine the revision. Equivalent forms are normalized. Changing the rule file produces a different revision. To use a new revision, recreate the registry, engine and clients. This does not automatically revoke clients in existing workers.