In TYPO3, assets like PDFs, TGZs or JPGs etc. are normally just referenced by a URL e.g. to fileadmin/.... The file itself is
delivered directly by the web server, and is therefore not part of the TYPO3 access control scheme – files remain unprotected,
since URLs can be re-used, emailed, Search engine included or even guessed.
The "Secure Downloads" extension (EXT:secure_downloads) changes this behavior: Files will now be accessed through a script that
honors TYPO3 access rights. The converted URL's will then look like this:
https://www.example.com/securedl/sdl-eyJ0eXAiOiJKV1QiLCJhbGciO[...]vcM5rWxIulg5tQ/protected_image.jpg
This works regardless of where the files come from and is not limited to special plugins, etc.
Since in most cases you will not want to protect everything (which means that everything undergoes rather performance-consuming access right checking), Secure Downloads is highly configurable. You may choose:
- what directories to protect (e.g. you can include typo3temp or not)
- what file types to protect (do you want to protect JPGs or not? etc.)
As a complementary measure, you will of course need to configure your web server not to deliver these things directly (e.g. using .htaccess settings).
We are currently supporting following TYPO3 versions:
| Extension Version | TYPO3 v12 | TYPO3 v11 | TYPO3 v10 |
|---|---|---|---|
| 6.x | x | - | - |
| 5.x 1) | - | x | x |
- 1) Upcoming release as
leuchtfeuer/secure-downloads(vendor name changed).
For the following versions no more free bug fixes and new features will be provided by the authors:
| Extension Version | TYPO3 v10 | TYPO3 v9 | TYPO3 v8 | TYPO3 v7 | TYPO3 v6.2 | TYPO3 v4.5 |
|---|---|---|---|---|---|---|
| 4.x | x | x | - | - | - | - |
| 3.x | - | x | x | - | - | - |
| 2.0.4 - 2.x | - | - | x | x | - | - |
| 2.0.0 - 2.0.3 | - | - | - | x | x | - |
| 1.x2) | - | - | - | - | x | x |
- 2) As
EXT:naw_securedlortypo3-ter/naw-securedl.
There are several ways to require and install this extension. We recommend getting this extension via composer.
If your TYPO3 instance is running in composer mode, you can simply require the extension by running:
composer req leuchtfeuer/secure-downloads:^6.0
Open the extension manager module of your TYPO3 instance and select "Get Extensions" in the select menu above the upload button.
There you can search for secure_downlaods and simply install the extension. Please make sure you are using the latest version
of the extension by updating the extension list before installing the Secure Downloads extension.
You need to download the Secure Downloads extension from the
TYPO3 Extension Repository and upload the ZIP file to the extension
manager of your TYPO3 instance and activate the extension afterwards.
You can also download an archive from GitHub and put its
content directly into the typo3conf/ext directory of your TYPO3 instance. But please keep in mind, that the name of the folder
must be secure_downloads (the repository name will be default).
After installation you need to configure this extension. Take a look at the corresponding section of the official manual.
You can configure this extension to fit your specific needs. However, here are some "best practices" that may help you when first using Secure Downloads:
- Install this extension as described above
- Create a new "File Storage" of type "Local filesystem" on page 0 of your TYPO3 instance and set the "Is publicly available?" option to false
- Create a directory on your filesystem which matches the previously configured "Base Path"
- Put an
.htaccessfile into that folder that denies the access to all files within and underneath this path - Configure the extension in the admin section of your TYPO3 Backend to match all files (use an astrix for the securedFiletypes option) in your newly created file storage (use the path for the securedDirs option).
You also need to secure all the directories and file types by your server configuration. This can be done with .htaccess files.
Some example .htaccess files can be found in the
Resources/Private/Examples
folder.
Note: This extension cannot secure links to files that you include in your CSS file. For example, you can secure /fileadmin
with the default .htaccess_deny file by putting the file in /fileadmin. You can allow /fileadmin/templates/ with the
default .htaccess_allow file by putting this file to /fileadmin/template/.
A detailed documentation can be found in the official TYPO3 documentation of this extension.
The changelog can be found in the changelog chapter of the official TYPO3 documentation of this extension.
You can contribute by making a pull request to the master branch of this repository, by using the "❤️ Sponsor" button on the top of this page, or just send us some beers 🍻...