Highlighted

AEM6.4.1: Block OPTIONS method call in an aem instance

Avatar

Avatar

nagas94895061

Avatar

nagas94895061

nagas94895061

05-08-2019

Hi Team,

We got an security issue on aem instance/server saying that our aem instance is allowing OPTIONS method calls and we need to disable that. Could you please help on this (Issue is specific to aem author/publish)

Thanks

Seran.

Replies

Highlighted

Avatar

Avatar

Arun_Patidar

MVP

Total Posts

2.9K

Likes

1.0K

Correct Answer

831

Avatar

Arun_Patidar

MVP

Total Posts

2.9K

Likes

1.0K

Correct Answer

831
Arun_Patidar
MVP

05-08-2019

One way is blocking from “Apache Sling Referrer Filter”

http://localhost:4504/system/console/configMgr/org.apache.sling.security.impl.ReferrerFilter

  • Filter Methods (String[]): defines which HTTP method(s) will be checked with the values in the allowed hosts before accepting incoming HTTP requests.
Highlighted

Avatar

Avatar

nagas94895061

Avatar

nagas94895061

nagas94895061

06-08-2019

Hi Arun,

Thanks for the inputs. I added "OPTIONS" method in “Apache Sling Referrer Filter” and tried below curl command. It is showing as allowed.

Curl Cmd: curl -i -X OPTIONS http://localhost:4503

Response:

HTTP/1.1 200 OK

Date: Tue, 06 Aug 2019 09:02:56 GMT

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

Allow: OPTIONS, TRACE, GET, HEAD

Content-Length: 0

Thanks

Seran

Highlighted

Avatar

Avatar

anujg3325839

Avatar

anujg3325839

anujg3325839

06-08-2019

Hi Seran, you can try  putting the deny method filters at the END of the filter section in your dispacther.any file

... all other filters ...

/1020 { /type “deny" /method "TRACE" /url "*" }

/1025 { /type “deny" /method "OPTIONS" /url "*" }

}

Highlighted

Avatar

Avatar

nagas94895061

Avatar

nagas94895061

nagas94895061

06-08-2019

Hi Anuj,

Thanks for the inputs. We want to block OPTIONS HTTP method on author & publish server. The issue is already addressed on our dispatcher server.

Thanks

Seran

Highlighted

Avatar

Avatar

Arun_Patidar

MVP

Total Posts

2.9K

Likes

1.0K

Correct Answer

831

Avatar

Arun_Patidar

MVP

Total Posts

2.9K

Likes

1.0K

Correct Answer

831
Arun_Patidar
MVP

06-08-2019

Hi,

I tried same on vanilla AEM instance with any config changes, I get below:

Capture3.PNG

Highlighted

Avatar

Avatar

nagas94895061

Avatar

nagas94895061

nagas94895061

06-08-2019

Hi Arun,

Could you please with publish instance, as the error sounds like an authentication issue for author.

Thanks

Seran

Highlighted

Avatar

Avatar

Arun_Patidar

MVP

Total Posts

2.9K

Likes

1.0K

Correct Answer

831

Avatar

Arun_Patidar

MVP

Total Posts

2.9K

Likes

1.0K

Correct Answer

831
Arun_Patidar
MVP

06-08-2019

Hi,

It is publish instance.