Skip to content
Snippets Groups Projects
  • Benjamin Franzke's avatar
    [FEATURE] Make backend URL configurable · a94b7b5f
    Benjamin Franzke authored
    The TYPO3 Backend URL is made configurable in order to enable optional
    protection against application admin interface infrastructure
    enumeration (WSTG-CONF-05). Both, frontend and backend requests are
    now handled by the PHP script `/index.php` to enable virtual admin
    interface URLs.
    
    The default TYPO3 Backend entrypoint path `/typo3` can be changed by
    specifying a custom URL path or domain name in
    `$GLOBALS['TYPO3_CONF_VARS']['BE']['entryPoint']`.
    
    This change requires web server adaption. A silent migration and
    according documentation for custom web server configurations is added.
    A deprecation layer (for non-adapted systems) is in place that rewrites
    the server environment variables passed to `/typo3/index.php` as if
    `/index.php` was used directly. This layer will be removed in TYPO3 v14.
    
    This change does not take assets into account, only routing is adapted.
    That means composer mode will use assets provided via _assets as before
    and TYPO3 classic mode will serve backend assets from /typo3/* even if
    another backend URL is used and configured.
    
    In composer mode there is an additional opt-out for the installation of
    the legacy entrypoint for that can be defined in composer.json:
    
      "extra": {
        "typo3/cms": {
          "install-deprecated-typo3-index-php": false
        }
      }
    
    The application flow is slightly adapted by moving common middlewares
    into a separate core middleware chain. This chain is dispatched by a
    distinct core HTTP application (which is invoked by index.php).
    These middlewares are suitable for proxy determination or generic
    access control – basically everything not needed for subrequests.
    The core HTTP request handler then decides whether the request is to be
    routed to the frontend or backend application. Frontend and backend
    appplications are still designed to work independently with a plain
    PSR-7 Server Request in order for sub requests from backend to frontend
    (or vice versa) to work.
    
    The following diagram outlines the new application workflow including
    flow of possible sub requests (not yet used from backend to frontend,
    but it shows how they are intended to be invoked):
    
                             +-------------------+
                             |                   |
                             |  Core HTTP        |
                             |  Application      |
                             |                   |
                             +---------+---------+
                                       |
                                       |
                                       v
                             +---------+---------+
                             |                   |
                             |  Core HTTP        |
                             |  Middlewares      |
                             |                   |
                             +---------+---------+
                                       |
                                       |
                                       v
                             +---------+---------+
                             |                   |
                             |  Core HTTP        |
               +-------------+  Request Handler  +--------------+
               |             |                   |              |
               |             +-------------------+              |
               |                                                |
               v                                                v
      +--------+----------+                           +---------+---------+
      |                   | (Sub Request)             |                   |
      |  Frontend HTTP    +<-------------+            |  Backend HTTP     |
      |  Application      +<-----------+ |            |  Application      |
      |                   |            | |            |                   |
      +---------+---------+            | |            +---------+---------+
                |                      | |                      |
                |                      | |                      |
                v                      | |                      v
      +---------+---------+            | |            +---------+---------+
      |                   |            | |            |                   |
      |  Frontend HTTP    |            | |            |  Backend HTTP     |
      |  Middlewares      |            | |            |  Middlewares      |
      |                   |            | |            |                   |
      +---------+---------+            | |            +---------+---------+
                |                      | |                      |
                |                      | |                      |
                v                      | |                      v
      +---------+---------+            | |            +---------+---------+
      |                   |            | |            |                   |
      |  Frontend HTTP    |            | |            |  Backend HTTP     |
      |  Request Handler  |            | |            |  Request Handler  |
      |                   |            | |            |                   |
      +---------+---------+            | |            +---------+---------+
                |                      | |                      |
                |                      | |                      |
                v                      | |                      v
      +---------+---------+            | |            +---------+---------+
      |                   |            | |            |                   |
      |  TypoScript       |            | |            |  Backend Route    |
      |  Frontend         +------------+ |            |  Dispatcher       |
      |  Controller       |              |            |                   |
      |                   |              |            +---------+---------+
      +-------------------+              |                      |
                                         |                      |
                                         |                      v
                                         |            +---------+---------+
                                         |            |                   |
                                         |            |  Backend          |
                                         +------------+  Controller       |
                                                      |                   |
                                                      +-------------------+
    
    Commands executed:
      # For changed in https://github.com/TYPO3/testing-framework/pull/533
      composer req --dev "typo3/testing-framework":"dev-main"
    
    Resolves: #87889
    Releases: main
    Change-Id: I3c96d4d7c58f08ed302ee35eb75d28afbf77686a
    Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74366
    
    
    Reviewed-by: default avatarOliver Hader <oliver.hader@typo3.org>
    Reviewed-by: default avatarStefan Bürk <stefan@buerk.tech>
    Tested-by: default avatarcore-ci <typo3@b13.com>
    Tested-by: default avatarStefan Bürk <stefan@buerk.tech>
    Tested-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
    Reviewed-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
    Tested-by: default avatarOliver Hader <oliver.hader@typo3.org>
    Reviewed-by: default avatarBenni Mack <benni@typo3.org>
    Tested-by: default avatarBenni Mack <benni@typo3.org>
    a94b7b5f