@varaande :
If your publisher is behind the Dispatcher , you need to check the filter section in dispatcher as we will deny everything by default and allow only what we need.
So as this extension of your url is .xdp , check your dispatcher configurations as are you allowing it or not.
like below config, we will allow only what we need.
# Enable extensions in non-public content directories, using a regular expression
/0041
{
/type "allow"
/extension '(css|gif|ico|js|png|swf|jpe?g)'
}
Thanks ,
Siva
Thanks,
Siva