Security and governance
The access of an application is never more than the access of its backend user. It is also never more than an administrator selected. This page gives a summary for a security review. See Scopes and Authentication for the details.
All requests pass the same checks#
Two ways to connect#
Static token: Use this for integrations between servers. The application uses one backend user. An administrator selects this user. The token does not expire.
OAuth 2.0: Use this for applications with many users. Each person logs in to TYPO3 and approves the access on a consent screen. This screen shows the application and the requested access. Access tokens are valid for one hour.
See the comparison of the app types.
How access stops#
Most changes apply on the next request, also to issued tokens.
401, the app is not available401, the old token is no longer valid. OAuth: the
app cannot get new tokens. Issued access tokens stay valid until
they expire after one hour.403 for all actions that need this scope403, the user has no scopes. This applies to static tokens and to
OAuth tokens| Action of the administrator | Result for the application |
|---|---|
| Disables the app | 401, the app is not available |
| Generates a new secret and saves the app | Static token: 401, the old token is no longer valid. OAuth: the
app cannot get new tokens. Issued access tokens stay valid until
they expire after one hour. |
| Removes a scope from the app | 403 for all actions that need this scope |
| Disables the backend user an app acts for | 403, the user has no scopes. This applies to static tokens and to
OAuth tokens |
| Changes the TYPO3 encryption key | All issued tokens become invalid |
Data protection#
- Location of the data
- API Hub operates in your TYPO3 installation and needs no additional service. The package does not send data to third parties. Connected applications get the data that their access allows.
- Secrets
- TYPO3 keeps only a SHA-256 digest of an app secret. TYPO3 shows the secret only one time, when you generate it.
- Passwords
- Records from the API do not contain passwords or password hashes. An application with the necessary permissions can set a password.
- Administrator data
- Tables for administrators, for example backend users, also need the scope
admin. Only an app whose backend user is an administrator can use this scope. - Errors
- The response to an unexpected error does not contain internal details. It contains a request ID. Use this ID to find the log entry.
The log#
TYPO3 writes changes of records and files to the system log, as in the backend.
The log shows the backend user, not the app. If apps use the same backend user, the log cannot identify the app. TYPO3 does not write read requests to the system log.
The log shows the backend user, not the app. If apps use the same backend user, the log cannot identify the app. TYPO3 does not write read requests to the system log.
Create one backend user for each static token app. Give this user only the necessary permissions. To record all requests, use the access log of your web server.
Create one backend user for each static token app. Give this user only the necessary permissions. To record all requests, use the access log of your web server.
Your responsibilities#
Include these items in your review:
| Topic | What to plan |
|---|---|
| Your own code | The TYPO3 Company is the manufacturer of the Suite components. You are responsible for your extensions, your actions and the integration in your project. |
| Transport encryption | Use only HTTPS for the API. Each request contains a token. |
| Rate limits | API Hub has no rate limits. If necessary, set them on your web server or in a reverse proxy. |
| Static tokens | They do not expire. Keep them in a secret store. Define when you replace them. |
| Administrators | An app with an administrator as backend user can access all data. Use backend users with limited permissions. |
| Periodic review | Review the list of apps at a fixed interval. Disable the apps that are not in use. |