[TYPO3-dev] Thoughts about security in BE

[Martin Kutschker]

Daniel Pötzinger schrieb:
 > - force IP check, referer check etc (build in)

A clever attacker overcomes this problem

 > - add htaccess to BE

And add what restriction? IP check, perhaps, but IP addresses can be spoofed.

> - force SSL

Won't help with XSS (or another hijacking method) unless you require client 
certificates.

Masi