Hi @ns334
Getting ResourceResolver from ResourceResolverFactory
Permissions: Requires a system user (data-reader in this example) configured in Apache Sling Service User Mapper.
Need to close resourceResolver explicitly once done with task.
Getting ResourceResolver from SlingHttpServletRequest
Permissions: Uses the current logged-in user’s credentials (subject to ACL restrictions).
No need to close resourceResolver, will be taken care by request.
Always use resourceResolver from request without opening new one until there are specific use case/need.