Automted CDN Cache Purge request failing | Community
Skip to main content
P
prananshupa1
April 29, 2025
Solved

Automted CDN Cache Purge request failing

  • April 29, 2025
  • 2 replies
  • 496 views

Hi All,

 

To automate CDN cache purge on publish, we implemented a EventHandler which listens to replication request and initiate HTTP Purge request from Author to Publish to clear out CDN cache for published page. However, this Purge request is failing and we are getting 403 response - 

Complete Error Response =

<!DOCTYPE html>
<html>
<head>
<title>403 Not allowed.</title>
</head>
<body>
<h1>Error 403 Not allowed.</h1>
<p>Not allowed.</p>
<p>Trace-id: 25477b2d-8605-4fdc-b2e4-a7890b18b998</p>
</body>
</html>

 

The same EventHandler works in local AEM instance and gives 200 response for Purge request. Implementation is similar like how it is given in this blog - https://experience-aem.blogspot.com/2023/01/aem-cloud-service-invalidate-dispatcher-purge-fastly-cdn-cache-api.html#:~:text=A%20simple%20servlet%20%2Fbin%2Feaem,demand%20for%20a%20page...&text=2)%20Purge%20the%20Page%20in,requested%20from%20the%20support..

 

JDK Version - 8

AEM cloud

We are passing correct Purge key

Note: Currently, Cloud Program network infrastructure is set to dedicated egress IP.

 

Any inputs or steps to resolve this issue will be appreciated. Thank you

Best answer by SantoshSai

Hi @prananshupa1,

I think, it's working in your local AEM, because, your machine sends the HTTP request directly to the dispatcher/CDN and is not behind Adobe's egress-controlled IP ranges.

In Cloud, Adobe's infrastructure enforces strict egress controls, and CDN vendors like Fastly or Akamai may block requests if:

  • The source IP is not explicitly allowed

  • Required headers (like Fastly-Key, or Host) are missing

  • The CDN is configured to only allow purges from specific endpoints (eg. via Adobe I/O or Fastly/Akamai API)


Can you confirm if the dedicated egress IP assigned to your program is allowed to perform purge requests. Also, you may need to whitelist the IP on the Fastly side.

Also, worth checking, if your request includes all required headers (for Fastly):

- Fastly-Key: YOUR_FASTLY_API_KEY
- Host: your.site.domain

Hope that helps!

2 replies

SantoshSai
Community Advisor
SantoshSaiCommunity AdvisorAccepted solution
Community Advisor
April 29, 2025

Hi @prananshupa1,

I think, it's working in your local AEM, because, your machine sends the HTTP request directly to the dispatcher/CDN and is not behind Adobe's egress-controlled IP ranges.

In Cloud, Adobe's infrastructure enforces strict egress controls, and CDN vendors like Fastly or Akamai may block requests if:

  • The source IP is not explicitly allowed

  • Required headers (like Fastly-Key, or Host) are missing

  • The CDN is configured to only allow purges from specific endpoints (eg. via Adobe I/O or Fastly/Akamai API)


Can you confirm if the dedicated egress IP assigned to your program is allowed to perform purge requests. Also, you may need to whitelist the IP on the Fastly side.

Also, worth checking, if your request includes all required headers (for Fastly):

- Fastly-Key: YOUR_FASTLY_API_KEY
- Host: your.site.domain

Hope that helps!

Santosh Sai
    AmitVishwakarma
    Community Advisor
    AmitVishwakarmaCommunity Advisor
    Community Advisor
    April 30, 2025

    Hi @prananshupa1 ,

    Root Cause:
    In AEM as a Cloud Service, Adobe uses dedicated egress IPs with strict outbound rules. Direct HTTP PURGE requests to CDNs like Fastly or Akamai will be blocked unless:
       - The egress IP is whitelisted in the CDN configuration:
       - The request includes all required headers (e.g., Fastly-Key, Host)
       - The CDN is configured to accept purges only via their official APIs (not from random IPs)
    Solution
    Step 1: Avoid Raw PURGE Requests – Use Fastly or Akamai API Instead
    Direct PURGE requests from AEM Cloud will almost always fail. Instead, use the CDN's API for cache invalidation.

    Fastly API Endpoint: POST https://api.fastly.com/service/<SERVICE_ID>/purge/<ENCODED_URL>

    Required Headers:

    Fastly-Key: YOUR_FASTLY_API_KEY Accept: application/json

    Step 2: Sample Java Code (Using Fastly API)

    URL url = new URL("https://api.fastly.com/service/<SERVICE_ID>/purge/<ENCODED_URL>"); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); conn.setRequestMethod("POST"); conn.setRequestProperty("Fastly-Key", "<your_api_key>"); conn.setRequestProperty("Accept", "application/json"); conn.setDoOutput(true); int responseCode = conn.getResponseCode(); if (responseCode == 200) { // Successfully purged } else { // Handle error }

    Step 3: Whitelist Adobe's Egress IPs

    If your AEM Cloud program uses dedicated egress IPs, make sure those IPs are whitelisted in your CDN (e.g., in Fastly's dashboard under Access Control > IP Whitelisting). If not done, the API call may still be blocked.

    Step 4: (Optional but Recommended) Use Adobe I/O Runtime or Adobe App Builder

    For even more control and scalability, consider triggering Fastly/Akamai cache invalidation via Adobe I/O Runtime using secure, serverless functions.


    Regards,
    Amit

    Terms & ConditionsAccessibility statement

    Loading footer...