AEM 6.5 : Permission Sensitive caching not working as expected

[MayankSa]

Hi Everyone - I did following implementation to enable permission sensitive caching in my AEM 6.5 instance:

1. Created an AuthCheckerServlet at /bin/permissionChecker

2. Added /auth_checker section in dispatcher file with uri mapped to uri in #1 above

3. Added allowAuthorized ="1" in /cache section

4. restarted dispatcher

I verified following in dispatcher log:

1. On dispatcher start, i see a message "Authorization checker: initialized with URL '/bin/permissionChecker'

2. When i go to any secured page, i see following in dispatcher log:

[Wed Oct 29 21:31:39 2025] [D] [xxx] Authorization checker: backend answered with status code: 403

[Wed Oct 29 21:31:39 2025] [D] [xxx] No socket reuse: response body not fully consumed

[Wed Oct 29 21:31:39 2025] [I] [xxx] authorization checker denied access: /mnt/var/www/html/content/abc/secure.html

[Wed Oct 29 21:31:39 2025] [D] [xxx] cache-action for [/content/abc/secure.html]: NONE

[Wed Oct 29 21:31:39 2025] [I] [xxx] "GET /content/abc/secure.html" 200 none [publishfarm/0] 53ms

I verified following in publish logs:

1. log message where i am explicitly setting response code 403:

response.setStatus(SlingHttpServletResponse.SC_FORBIDDEN);

I tried multiple options but i am unable to deny access to secure.html. Want to check if i missed any steps of any additional configurations?

Thanks in advance

[Karishma_begumSh]

Hi @MayankSa 

Your setup is almost right — the issue is likely AEM publish permissions or the AuthCheckerServlet response.

Quick checklist:

1.Servlet must return:

200 → authorized

403 → unauthorized (no redirect, no body)

2.dispatcher.any:

/auth_checker {
  /url "/bin/permissionChecker"
  /filter {
    /0001 { /glob "/content/abc/secure/*" /type "allow" }
  }
}
/cache { /allowAuthorized "1" }

3.Remove anonymous read access on /content/abc/secure in AEM Publish.

4.Ensure Dispatcher farm handling this path has the /auth_checker config.

If secure pages are still served with 200, your publish instance is allowing public access.

Hope this helpful:)

Regards,

Karishma.

[ManviSharma · Accepted solution]

Hello,

1. Create the AuthCheckerServlet at /bin/permissionChecker. It should return HTTP 200 if access is allowed and HTTP 403 with an empty body if access is denied.

2. In the Dispatcher configuration file (dispatcher.any or .farm), add the following:
   
   /auth_checker {
   /url "/bin/permissionChecker"
   /timeout "3000"
   }
   
   In the /cache section, set /allowAuthorized "1". Optionally, add rules to protect secure pages:
   
   /rules {
   /0001 { /glob "*"; /type "allow" }
   /0002 { /glob "/content/abc/secure.html"; /type "deny" }
   }

3. Restart the  Dispatcher to apply the new configuration.

4. Verify the setup by checking Dispatcher logs for initialization of /bin/permissionChecker and 403 responses on secure pages. Also confirm the servlet returns correct status codes.

5. Test by accessing a secure page as an unauthorized user; Dispatcher should return 403 Forbidden and not cache the response.