AEM6.5.12: Block OPTIONS method call in an AEM Author and Publish Instance

Hi @mujeeburrehman 

Similar query is answered here: https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/how-to-block-http-options-request-in-aem/m-p/363827

Hope it helps!

Thanks,
Kiran Vedantam.

@mujeeburrehman  Seems we don't have any OOTB feature to disable the HTTP Methods. We can do by using a servlet filter to check the incoming request and reject any requests with the Options

Servlet filter :

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class DisableOptionsFilter implements Filter {
   public void init(FilterConfig config) throws ServletException {}

   public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException {
      if (((HttpServletRequest) request).getMethod().equalsIgnoreCase("OPTIONS")) {
         ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
      } else {
         chain.doFilter(request, response);
      }
   }

   public void destroy() {}
}

And below is the OSGi

import org.osgi.service.component.annotations.Component;

import javax.servlet.Filter;

@Component(
      service = Filter.class,
      property = {
            "sling.filter.scope=REQUEST",
            "sling.filter.pattern=(/.*)(\\.(html|json|xml))?($|/.*)"
      }
)
public class DisableOptionsFilterConfig extends DisableOptionsFilter {}