System Setup 

Allowed hosts for server-side requests 

To prevent server-side request forgery (SSRF), the server only fetches documents and document resources from hosts that are either publicly routable or listed in the extension configuration.

The setting general.urlAllowList is a comma-separated list of host names that the server may fetch even if they do not resolve to a public address. Wildcards such as *.example.org are supported.

general.urlAllowList = kitodo-production.example.org, *.iiif.example.org

Copied!

If a document is loaded from an internal host, or if a document references resources on an internal host (for example an IIIF image server or an annotation server), that host must be listed here. Otherwise the request is refused and a warning is written to the TYPO3 log.

Note that hosts which resolve to private, loopback, link-local or otherwise reserved addresses are rejected by default. This includes the cloud metadata address 169.254.169.254. Redirects are validated in the same way, so a document cannot be used to reach an internal service through a redirect either.

Disable caching in certain situations 

Navigation Plugin 

The navigation plugin provides a page selection dropdown input field. The resulting action url cannot contain a valid cHash value.

The default behaviour of TYPO3 is to call the pageNotFound handler and/or to show an exception:

This is not the desired behaviour. You should disable $TYPO3_CONF_VARS['FE']['pageNotFoundOnCHashError'] = 0 to show the requested page instead. The caching will be disabled in this case. This was the default behaviour before TYPO3 6.x.

This configuration is written to typo3conf/LocalConfiguration.php:

'FE' => [
        'pageNotFoundOnCHashError' => '0',
    ],

Copied!

'FE' => [
    'cacheHash' => [
        'requireCacheHashPresenceParameters' => [
            'tx_dlf[id]',
        ],
    ],
]

TypoScript Basic Configuration 

Please include the Template "Basic Configuration (dlf)". This template adds jQuery to your page by setting the following typoscript:

page.includeJSFooterlibs.jQuery

Slug Configuration 

With TYPO3 9.5 it is possible to make speaking urls with the builtin advanced routing feature ("Slug"). This may be used for extensions too.

TYPO3 documentation about Advanced Routing Configuration.

The following code is an example of an routeEnhancer for the workview page on uid=14.

routeEnhancers:
  KitodoWorkview:
    type: Plugin
    namespace: tx_dlf
    limitToPages:
      - 14
    routePath: '/{id}/{page}'
    requirements:
      id: '(\d+)|(http.*xml)'
      page: \d+
  KitodoWorkviewDouble:
    type: Plugin
    namespace: tx_dlf
    limitToPages:
      - 14
    routePath: '/{id}/{page}/{double}'
    requirements:
      id: '(\d+)|(http.*xml)'
      page: \d+
      double: '[0-1]'