typo3-security

TYPO3 Security Hardening

Source: https://github.com/dirnbauer/webconsulting-skills

Compatibility: TYPO3 v14.x Configuration examples require verification against the installed v14 source and the deployment's trust/proxy model; they are not a universal drop-in preset.

For an assessment, inspect and report without changing configuration, accounts or permissions. Implement hardening only when requested. Inside an upgrade graph, address the assigned finding and return evidence; unrelated hardening belongs to separately authorized scope, not an automatic loop.

TYPO3 API First: Always use TYPO3's built-in APIs, core features, and established conventions before creating custom implementations. Do not reinvent what TYPO3 already provides. Always verify that the APIs and methods you use exist and are not deprecated in TYPO3 v14 by checking the official TYPO3 documentation.

1. Critical Configuration Settings

config/system/settings.php (TYPO3 v14)

<?php
return [
    'BE' => [
        // Disable debug in production
        'debug' => false,
        
        // Session security (example hardening values — tune for proxies/load balancers)
        'lockIP' => 4,                    // Example: bind backend sessions to the full IPv4 address
        'lockIPv6' => 8,                  // Lock to IPv6 prefix
        'sessionTimeout' => 3600,         // 1 hour session timeout
        'lockSSL' => true,                // Example: require HTTPS for backend requests
        
        // Password policy (TYPO3 v14)
        'passwordHashing' => [
            'className' => \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class,
            'options' => [],
        ],
    ],
    
    'FE' => [
        'debug' => false,
        'lockIP' => 0,                    // Common for frontend sessions; mobile users / proxies often change IPs
        'sessionTimeout' => 86400,
        // `lockSSL` is BE-only (there is no `FE.lockSSL`) — enforce HTTPS for the frontend at the **web server / proxy** and send **HSTS** (`Strict-Transport-Security: max-age=31536000; includeSubDomains`) for production hosts
        'passwordHashing' => [
            'className' => \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class,
            'options' => [],
        ],
    ],
    
    'SYS' => [
        // NEVER display errors in production
        'displayErrors' => 0,
        'devIPmask' => '',                // No dev IPs in production
        'errorHandlerErrors' => E_ALL & ~E_NOTICE & ~E_DEPRECATED,
        'exceptionalErrors' => E_ALL & ~E_NOTICE & ~E_WARNING & ~E_DEPRECATED,
        
        // Encryption key (generate unique per installation)
        'encryptionKey' => 'generate-unique-key-per-installation',
        
        // Trusted hosts pattern (CRITICAL) — Core wraps the pattern in `/^...$/`; omit `^` and `$`. Avoid `.*example\\.com` (without `\\.` before `example` — matches `evil-example.com`). Note: `.*\\.example\\.com` requires a subdomain and won't match bare `example.com`.
        'trustedHostsPattern' => '(www\\.)?example\\.com',
        
        // File handling security
        'textfile_ext' => 'txt,html,htm,css,js,tmpl,ts,typoscript,xml,svg',
        'mediafile_ext' => 'gif,jpg,jpeg,png,webp,svg,pdf,mp3,mp4,webm',
        
        // Security feature toggles — names and availability differ by minor release; confirm in Core docs for your exact version
        'features' => [
            'security.backend.enforceReferrer' => true,
            // Frontend CSP toggles (names stable from v12+; confirm in reference for your minor)
            'security.frontend.enforceContentSecurityPolicy' => false,
            'security.frontend.reportContentSecurityPolicy' => false,
        ],
    ],
    
    'LOG' => [
        'writerConfiguration' => [
            \Psr\Log\LogLevel::WARNING => [
                \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [
                    'logFile' => 'var/log/typo3-warning.log',
                ],
            ],
            \Psr\Log\LogLevel::ERROR => [
                \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [
                    'logFile' => 'var/log/typo3-error.log',
                ],
                \TYPO3\CMS\Core\Log\Writer\SyslogWriter::class => [],
            ],
        ],
    ],
];

2. Trusted Hosts Pattern

CRITICAL: Always configure trustedHostsPattern to prevent host header injection.

// ❌ DANGEROUS - Allows any host
'trustedHostsPattern' => '.*',

// ✅ SECURE - Explicit host list (Core adds `/^...$/` around the pattern)
'trustedHostsPattern' => '(?:example\\.com|www\\.example\\.com)',

// ✅ SECURE - Regex for subdomains (tie to your registrable domain)
'trustedHostsPattern' => '(.*\\.)?example\\.com',

// Development with DDEV
'trustedHostsPattern' => '(?:(?:.*\\.)?example\\.com|.*\\.ddev\\.site)',

3. File System Security

fileDenyPattern (upload / public file access)

Keep Core’s deny list strict — extend only when you understand the risk:

Warning: setting fileDenyPattern replaces Core’s default pattern entirely. Always start from the v14 default (\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi)(\\..*)?$|\\.pl$|^\\.htaccess$) and append — never drop pht, phpsh, shtml, or ^\.htaccess$.

// Example: keep Core's v14 default and append extra executable extensions (adjust to your policy)
$GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern'] = '\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi|sh|bash|py|asp|aspx|jsp)(\\..*)?$|\\.pl$|^\\.htaccess$';

Directory Permissions

Keep application code and Composer dependencies owned by the deployment identity, readable but not writable by PHP. Give the runtime write access only to inspected cache/log/upload paths such as var/, public/fileadmin/ and public/typo3temp/. Account for the deployment's shared directories, ACLs and symlinks before changing ownership or modes.

Choose separate modes for directories and files: for a private shared runtime group, 2770 directories and 0660 files are possible choices, not universal defaults. 2 is the setgid bit, not the sticky bit. Do not recursively mark ordinary files executable or make the whole application writable by the web user. Configuration containing secrets needs runtime read access but only the intended configuration-management process may write it. Verify as the actual runtime user and test upload, cache rebuild and deployment afterward.

Critical Files to Protect

Never expose these in public/:

❌ var/log/
❌ config/
❌ .env
❌ composer.json
❌ composer.lock
❌ .git/
❌ vendor/ (should be outside public)

Web server rules and security headers

Apache .htaccess and Nginx blocks that deny hidden files, sensitive file types, and PHP execution under fileadmin, plus the standard security headers, are in references/web-server-hardening.md — with the rule that matters most: set each header at one layer only, and verify with curl -I rather than trusting the config. .htaccess does not control Nginx; check which server serves the site first.

4. Install Tool Security

Disable Install Tool

# Remove enable file after installation
# Composer-based TYPO3 v14: file is in var/transient/
rm var/transient/ENABLE_INSTALL_TOOL

Secure Install Tool Password

Generate strong password and store securely:

# Generate random password
openssl rand -base64 32

Set the hashed password via the Install Tool or an environment-specific config/system/additional.php; never commit a placeholder or empty string.

IP Restriction for Install Tool

Restrict the Install Tool entry point (/typo3/install.php on Composer-based v14) to trusted IPs at the web-server level:

# Apache: server / virtual-host configuration ONLY, not .htaccess
<LocationMatch "^/typo3/install\.php">
    Require ip 203.0.113.0/24
    Require ip 198.51.100.42
</LocationMatch>

Apache's LocationMatch context excludes .htaccess. Run the server's configuration test before an authorized reload.

# Nginx
location = /typo3/install.php {
    allow 203.0.113.0/24;
    allow 198.51.100.42;
    deny  all;
    # ...existing fastcgi_pass / include snippet...
}

Note: $GLOBALS['TYPO3_CONF_VARS']['SYS']['devIPmask'] only governs exposure of dev/debug tooling (e.g. the admin panel and debug output) — it does not restrict or authenticate the Install Tool. Lock the Install Tool down at the web server (above) in addition to setting a strong installToolPassword.

5. Backend User Security

Strong Password Policy (TYPO3 v14)

<?php
// ext_localconf.php of site extension
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'default'; // policy *name* only
$GLOBALS['TYPO3_CONF_VARS']['SYS']['passwordPolicies']['default'] = [
    'validators' => [
        \TYPO3\CMS\Core\PasswordPolicy\Validator\CorePasswordValidator::class => [
            'options' => [
                'minimumLength' => 12,
                'upperCaseCharacterRequired' => true,
                'lowerCaseCharacterRequired' => true,
                'digitCharacterRequired' => true,
                'specialCharacterRequired' => true,
            ],
        ],
        \TYPO3\CMS\Core\PasswordPolicy\Validator\NotCurrentPasswordValidator::class => [],
    ],
];

Multi-Factor Authentication (TYPO3 v14)

MFA is built into TYPO3 v14. Users can configure in: User Settings > Account Security

Supported providers:

• TOTP (Time-based One-Time Password)
• Recovery Codes

Configure MFA enforcement in config/system/settings.php via $GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa']: 0 disabled, 1 all users, 2 non-admins, 3 admins only, 4 system maintainers only — confirm exact semantics in Core docs for your minor), or per user/group with user TSconfig auth.mfa.required:

# User or group TSconfig — require MFA for those accounts (overrides global when set)
auth.mfa.required = 1

See Multi-factor authentication.

Backend Access Logging

// Log all backend logins
$GLOBALS['TYPO3_CONF_VARS']['LOG']['TYPO3']['CMS']['Backend']['Authentication']['writerConfiguration'] = [
    \Psr\Log\LogLevel::INFO => [
        \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [
            'logFile' => 'var/log/backend-auth.log',
        ],
    ],
];

6. Content Security Policy (CSP)

Built-in CSP (TYPO3 v14)

TYPO3 v14 has built-in CSP support. Enable it:

Enable CSP through config/system/settings.php / Install Tool. Frontend toggles (names may evolve — verify in Core for your minor) commonly include: $GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.enforceContentSecurityPolicy'] and security.frontend.reportContentSecurityPolicy. Backend CSP is enforced by default since v13 — there is no equivalent FE-style toggle for BE.

CSP Configuration via Events (TYPO3 v14)

<?php
declare(strict_types=1);

namespace Vendor\Extension\EventListener;

use TYPO3\CMS\Core\Attribute\AsEventListener;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Event\PolicyMutatedEvent;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\UriValue;

#[AsEventListener(identifier: 'vendor-extension/csp-modification')]
final class ContentSecurityPolicyListener
{
    public function __invoke(PolicyMutatedEvent $event): void
    {
        if (!$event->scope->type->isFrontend()) {
            return;
        }

        $policy = $event->getCurrentPolicy()
            ->extend(Directive::ScriptSrc, new UriValue('https://cdn.example.com'))
            ->extend(Directive::StyleSrc, new UriValue('https://fonts.googleapis.com'));

        $event->setCurrentPolicy($policy);
    }
}

TypoScript CSP Headers (Alternative)

config.additionalHeaders {
    10.header = Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; frame-ancestors 'self';
}

7. SQL Injection Prevention

ALWAYS Use QueryBuilder

<?php
declare(strict_types=1);

// ❌ VULNERABLE - Never do this
$result = $connection->executeQuery(
    "SELECT * FROM pages WHERE uid = " . $_GET['id']
);

// ✅ SECURE - Use QueryBuilder with prepared statements
$queryBuilder = $this->connectionPool->getQueryBuilderForTable('pages');
$result = $queryBuilder
    ->select('*')
    ->from('pages')
    ->where(
        $queryBuilder->expr()->eq(
            'uid',
            $queryBuilder->createNamedParameter($id, \TYPO3\CMS\Core\Database\Connection::PARAM_INT)
        )
    )
    ->executeQuery();

Extbase Repository Safety

<?php
declare(strict_types=1);

// Extbase automatically escapes parameters
$query = $this->createQuery();
$query->matching(
    $query->equals('uid', $id)  // Safe - auto-escaped
);

8. XSS Prevention

Fluid Templates

<!-- ✅ SAFE - Auto-escaped -->
{variable}

<!-- ❌ DANGEROUS - Raw output -->
{variable -> f:format.raw()}

<!-- ✅ SAFE - Explicit escaping -->
{variable -> f:format.htmlspecialchars()}

<!-- For HTML content, use with caution -->
<f:format.html>{bodytext}</f:format.html>

Backend Forms

TCA automatically handles escaping. For custom fields:

'config' => [
    'type' => 'input',
    'max' => 255,
    // Input is automatically escaped
],

9. CSRF Protection

Backend Requests (TYPO3 v14)

TYPO3 backend automatically includes CSRF tokens. For custom AJAX:

<?php
declare(strict_types=1);

use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;
use Psr\Http\Message\ServerRequestInterface;

final class MyController
{
    public function __construct(
        private readonly FormProtectionFactory $formProtectionFactory,
    ) {}

    public function generateToken(ServerRequestInterface $request): string
    {
        $formProtection = $this->formProtectionFactory->createFromRequest($request);
        return $formProtection->generateToken('myFormIdentifier');
    }

    public function validateToken(ServerRequestInterface $request, string $token): bool
    {
        $formProtection = $this->formProtectionFactory->createFromRequest($request);
        return $formProtection->validateToken($token, 'myFormIdentifier');
    }
}

Frontend Forms (Extbase)

<!-- Fluid generates its own reserved property-mapping fields. -->
<f:form action="submit" controller="Contact" method="post">
    <f:form.textfield name="message" />
</f:form>

__trustedProperties protects Extbase property mapping; it is not a session-bound CSRF token. Do not inject that reserved field manually or claim <f:form> alone protects an anonymous endpoint. The handler must reject missing/invalid CSRF tokens before side effects. Core's FormProtectionFactory uses a dummy implementation without an authenticated frontend/backend user. For anonymous forms, use the application's supported session-bound protection and prove rejection with a forged cross-origin submission; do not present dummyToken as protection.

Appendix

For TYPO3 v14-specific hardening notes and related-skill links, see references/v14-notes.md. For go-live checklists, rate limiting, and remaining v14 security notes, see references/checklists.md.

---

Credits & Attribution

Source: https://github.com/dirnbauer/webconsulting-skills