Adobe Experience Manager Sites

Hi Team,We are observing a very high volume of requests hitting AEM internal Granite APIs:/libs/granite/csrf/token.json (~618K requests, ~19%) /libs/granite/security/currentuser.json (~300K requests, ~9.3%)Together, these endpoints account for nearly 29% of total traffic in our logs.We understand these endpoints are used for authentication/session handling, but this volume seems unusually high and is impacting overall traffic patterns.We would like guidance on:Is this level of traffic expected for these endpoints in Adobe Experience Manager (especially Cloud Service)? What are the recommended best practices to reduce or optimize calls to these APIs?      Dispatcher/CDN rules? Frontend implementation improvements? Could this indicate a misconfiguration (e.g., frequent polling, missing caching, or bot traffic)? Are there Adobe-recommended patterns to minimize repeated CSRF token and current user calls? Any insights or similar experiences would be really helpful. Thanks in advance!

I wanted to understand whether this is advisable for PII data to be stored within AEM, and what the recommended best practices are.Some of the questions we’re exploring:Is it recommended to store PII in AEMaaCS, even in encrypted form? How does Adobe protect sensitive data at rest and in transit within AEMaaCS? Are there any Adobe guidelines on handling PII in JCR repositories? How is it protected from any external attack threats? Can we implement custom encryption (e.g., using an OSGi service) before storing data? Are there recommended alternatives, such as storing the PII in a secured backend system instead of AEM?Would appreciate insights from Adobe experts and the community on the right architectural approach for handling PII securely in AEMaaCS.

Dear AEM Community,Your time is precious, and we understand the importance of efficiency when it comes to troubleshooting issues with AEM.That's why we're excited to again bring you our carefully curated collection of Top KCS (Knowledge-Base) Articles for March 2026, designed to help you resolve common challenges swiftly and effectively.Our Top KCS Articles are your shortcut to:Quickly identifying and resolving recurring issues. Accessing expert insights and best practices for AEM. Streamlining your troubleshooting process for maximum productivity. Empowering yourself with the knowledge to tackle any AEM-related problem head-on.Why spend hours searching for solutions, when our Top KCS Articles have already done the heavy lifting for you?Let us help you save time so you can focus on what truly matters – empowering you to provide a truly personalized experience to your customers with AEM.Start supercharging your problem-solving skills today by exploring our Top KCS Articles!Take a look:W

Check out the list of AEM User Group meetings happening in April:🌷 [VIRTUAL] April 15 @ 12pm ET: "Adobe Summit Prep 2026: Know Before You Go" with AEM - Midwest Chapter🌷 [VIRTUAL] April 28 @ 10am ET: "Adobe Summit 2026 Recap – focused on AEM Assets" with the AEM - Global DAM Chapter🌷 [VIRTUAL] April 30 @ 2pm IST: "AEM APAC Office Hours: Adobe Summit 2026 Recap" with AEM Champion Office Hours👉 See you there!: https://aem-augs.adobe.com/events/#/list

Adobe's MCP servers are great. But what if you could build AI tools designed exactly for your business or development use-case?In my latest article, I show how to custom-build MCP integrations in TypeScript so AI tools like Claude or Cursor can:🗂️ Find and act on expiring DAM assets in plain language⚡ Bulk update metadata without juggling the UI🔍 Query logs with natural prompts like “show errors from the last 4 hours”🔗 Chain multiple operations in one smart prompt And the best part? It works for on-prem, AMS, and AEMaaCS setups - all tailored to your deployment, letting AI do the heavy lifting while keeping you in control 🎯 Check the article here: https://medium.com/@vorajineet/aem-mcp-your-way-design-business-specific-ai-tools-for-any-aem-deployment-ff66c3fde22dLink to Github: https://github.com/vorajineet/aem-mcp-server

Are there recommendations/best practices to manage content as code.One of the team I work with mentioned this as their problem statement “Our code gets deployed through Cloud Manager but our QA cannot test anything yet nor can automated regression tests be triggered through Continuous Test Pipelines because they have to wait until content is authored.”The human element in the process feels like a huge bottle neck in the process as it is hindering immediate feedback loop.I am trying to understand what strategies other enterprises who use AEM have implemented in their SDLC process.For example in a sprint, if the code and content are planned to be delivered together, cant the content creators(BA/Business) be ready with the content that go in with the fragments that get deployed as part of code 

Hi Community,I’m looking for suggestions and best practices around importing Salsify product data into AEM, specifically for creating or updating Content Fragments.Current ArchitectureSalsify product data is exported and stored in AEM DAM as .txt files. AEM Workflow is triggered on these DAM assets The workflow: Reads the Salsify JSON Creates Product Pages Sets product properties on the pages based on the JSON This approach is currently page‑centric, driven by workflow logicNew / Evolving RequirementWe are exploring a shift to:Content Fragments as the primary product data source Importing product data via: CSV files where one or more columns contain Salsify JSON, or Directly from JSON assets Mapping Salsify attributes to Content Fragment Models Supporting re‑imports / updates (idempotent behavior)What I’m Looking ForI’d appreciate guidance on:Recommended patterns for CSV/JSON → Content Fragment creation Whether workflows are still the preferred approach, or if: Custom servlets Sc

Adobe photoshop is failing and wont reinstall

trying to execute "aio login" and result is:Visit this url to log in: https://aio-login.adobeioruntime.net/api/v1/web/default/applogin?id=********&port=*****&redirect_uri=https%3A%2F%2Faio-login.adobeioruntime.net%2Fapi%2Fv1%2Fweb%2Fdefault%2Fapplogin%2Flogin-success - Waiting for browser loginnode:events:497 throw er; // Unhandled 'error' event ^ Error: spawn undefined\System32\WindowsPowerShell\v1.0\powershell ENOENT at ChildProcess._handle.onexit (node:internal/child_process:285:19) at onErrorNT (node:internal/child_process:483:16) at process.processTicksAndRejections (node:internal/process/task_queues:90:21) Emitted 'error' event on ChildProcess instance at: at ChildProcess._handle.onexit (node:internal/child_process:291:12) at onErrorNT (node:internal/child_process:483:16) at process.processTicksAndRejections (node:internal/process/task_queues:90:21) { errno: -4058, code: 'ENOENT', syscall: 'spawn undefined\\System32\\WindowsPower

How do I create a custom API on AEM so that any external system (ex: postman, curl) can access the API via some authentication(OAUTH/SAML). Once the handshake is done external system needs to send AEM some data, AEM will do some business process and pass a response.

Hi All,AEM: 6.5.12I’m encountering this issue for the first time. I’m currently using the AEM OOTB Sitemap generator for testing purposes. However, when I try to use the scheduler approach, the job gets stuck and doesn't trigger. please refer below screenshot.  The logs don’t provide much information. I’ve attempted to create the scheduler through /system/console/ConfigMgr and even added a run mode, but it still doesn’t work. However, the "On Demand" approach works perfectly fine. I checked from status-slingsitemap and it appears as scheduled.I've done the the following actions:- re-index from oak:index -> slingSitemap- Adding  the config to be placed "/apps/system/conf/ (didn't work)- Adding runmode config (didn't work).- flushing classloader (didn't work).Is there a way to know if the scheduler got stuck somehow?. if so, do you know the path where I can check it?. Previosly, it was working fine but not sure what changed. 

Hi All, I am trying to set up universal editor in my local and usinig AEM Cloud Service SDK (aem-sdk-2025.9.22758.20250928T092442Z-250900) for local development.I have done below set upAEM - http running on port 4502AEM - https running on port 8443Local universal editor service running on port 8000Trusted the local certificate in the browser for self signed certificatesThe problem I am facing is,when I try to load AEM page running on https (port 8443) inside universal editor, it gives this error "Blocked autofocusing on a <input> element in a cross-origin subframe." I followed whats mentioned in this document - https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/implementing/developing/universal-editor/developer-overview?lang=en for same site cookie settings but it doesn't help and I continue getting the cross origin error. Has anyone come across the same issueThere is no Universal editor service related configuration available

I am running my AEMaaCS local SDK and I keep getting ERROR likecom.adobe.aem.wcm.dataplane.rewriter.MetaTagExternalPageIdTransformer authorSourceLocator is null. AEM_SERVICE env var is missing or malformedI am starting the AEM instance with java -jar aem-author-dev-p4502.jar -r author,dev,localI tried setting AEM_SERVICE = “author”environment variable (in addition to other vars I am setting), but it does not helpIt may be harmless, but its polluting my logs and is annoying when trying to find real errors.Whats the proper value to set, to silence this? 

Hi all,I hope you are doing well! This is continution to while upgrading to AEM 6.5 LTS i’m facing challenges with guava library replacement/alternatives.as per the LTS analyzer guidance, “The `15.0.0.0002` bundle version of Guava is no longer available out of the box in AEM 6.5 LTS due to critical security vulnerabilities. Please update and use latest non-vulnerable version of guava.”, so started with using latest versions with no vulnerabilities.<!-- Source: https://mvnrepository.com/artifact/com.google.guava/guava --><dependency>    <groupId>com.google.guava</groupId>    <artifactId>guava</artifactId>    <version>33.5.0-jre</version>    <scope>compile</scope></dependency> This is working at Java side but not at AEM instance, because there is no such library provided by Adobe runtime, so we need to embed this ourselves in our application generated bundle, this is failed because ‘com.google.guava’ bundle is a multi-rele

We are using the WCM Core component PDF Viewer (https://experienceleague.adobe.com/en/docs/experience-manager-core-components/using/wcm-components/pdf-viewer) on our site to improve the pdf experience of our customers but we are getting analytics cookies coming along for the ride:acrobatservices.adobe.comdc-api.adobe.iop.typekit.netp13n.adobe.iouse.typekit.netviewlicense.adobe.ioObviously we need to make sure if the users disables analytic cookies in our cookie consent manager that these cookies don’t get dropped.This isn’t a problem for js that we managed in Adobe Tags, we have rules to wire it up to the consent manager but im not sure how to go about wiring up these cookies from this core component.Any ideas?

Hi everyone,I am working on extending the AEM Rich Text Editor (RTE) to add custom functionality for tables. Specifically, I want to add two buttons to the table toolbar: Cell Background Color (origintable#cellbg) Cell CSS Class (origintable#cellclass) I have implemented a custom Plugin and Command using CUI.rte.plugins.Plugin and CUI.rte.commands.Command. While the current implementation works using window.prompt, I would like to know if this approach is considered "best practice" or if there are more "AEM-native" ways to handle this (e.g., using Coral UI dialogs instead of browser prompts).Current Implementation Details: Plugin Registration: Using CUI.rte.plugins.PluginRegistry.register. UI Initialization: Adding elements to the tableEditOptions toolbar via tbGenerator.addElement. Data Persistence: Manually triggering the change event on the editable container after updating the DOM via jQuery. Code Snippets:1. Plugin Logic (cell-bg-plugin.js):(function ($, CUI) { 'use stric

Some of our authors reporting intermittent issue (like once a month per user behavior) while authoring pages in our internal prod author.Issue is that they are not able to save component dialogs in middle of authoring work even though they are able to login and navigate through pages. They get error failed to submit form. Upon clearing cache for all time and logging in again only is fixing this issue. Same time they are able to edit and save using other browser.upon checking HAR file we see that the csrf token request is giving 403 response (I think only post calls are not getting authenticated) and on further checking their login-token cookie is missing in the browser. This issue is not getting solved until they clear cache for all time and force login back.Is there any reason why the login-token OOTB cookie get dropped or not being set for a logged in session (even though the user is logged in and can navigate through pages and even can see component edit dialogs)?Below are some log

Hello Everyone, We have observed an inconsistency between the Content Fragment Editor and the Universal Editor regarding enforcement of Content Fragment model constraints.A multi-value field  in our Content Fragment model is configured with Maximum number of items = 3.In the Content Fragment Editor, this constraint is respected and authors are prevented from adding more than three entries. In the Universal Editor, the same field allows adding a fourth item, and the value is persisted without any validation error. After saving from the Universal Editor, reopening the fragment shows all four values stored in the repository.This suggests that the Universal Editor does not currently enforce the max items constraint defined in the Content Fragment model.Please confirm:Whether this behavior is expected or a known issue If there are plans to align Universal Editor validation with Content Fragment model constraints Whether any server-side validation or configuration is recommended to prevent t