Right way to expose an endpoint/servlet from AEM author to 3rd party?

Hi,

One approach can be exposing the servlet endpoint.

Security check can be at env level  by whitelisting only certain IP of third party(or use Mutual TLS) 

Apart from that at dispatcher level only defined set of method whether get or post should be allowed

We can sanitise payload in servlet with jsoup

Make sure to user service user with minimum required access like narrow down certain path and operations

Thanks

Hello,

you didn't mention what version of AEM are you using. In case you are on AEMaaCS please refer to this documentation: https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/implementing/developing/generating-access-tokens-for-server-side-apis

Good luck,

Daniel

Hi @rajumuddana ,

Exposing an endpoint in AEM Author for a third-party system to make POST calls can be tricky, especially with authentication concerns. Your lead might be raising concerns about security and best practices. Here are a few points to consider:

1. Authentication Mechanism: If you are using Basic Authentication, ensure that the credentials are securely managed. It's also good practice to use HTTPS to encrypt the transmission.

2. Token-Based Authentication: Instead of Basic Authentication, consider using a more secure method like OAuth or JWT. This way, you can generate tokens for the third-party system that can be validated by AEM.

3. IP Whitelisting: While whitelisting the IP of the third-party system is a good practice, it should be part of a broader security strategy.

4. Endpoint Validation: Implement additional validation on the AEM side to ensure that the incoming requests are genuinely from the expected third-party service. This could include checking specific headers, payload structures, or signatures.

5. Access Control: Ensure that the endpoint only allows the required operations (e.g., POST) and that appropriate permissions are in place.

6. Logging and Monitoring: Set up logging and monitoring for incoming requests to track usage and identify potential issues.

for AEMaaCS: https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/implementing/developing/generating-access-tokens-for-server-side-apis check this documentation.

- Sravan

I am not sure about your use case to use AEM for expose something, but I am sure certainly this is not a way to do this specially in case of POST call.
My be after knowing your use case I will suggest some way in achieving your task done.

By the way people are using SlingServlet for the same purpose my be this could help you but be informed that will have its own cost for your instance.

Hope this helps

Umesh Thakur

@rajumuddana Did you find the suggestions helpful? Please let us know if you require more information. Otherwise, please mark the answer as correct for posterity. If you've discovered a solution yourself, we would appreciate it if you could share it with the community. Thank you!