Disable jcr:content.json from URL on publisher instance in AEM | Community
Skip to main content
tushaar_srivastava
tushaar_srivastava
Level 6
January 20, 2020
Solved

Disable jcr:content.json from URL on publisher instance in AEM

  • January 20, 2020
  • 1 reply
  • 5880 views

Hi,

End users are able to access jcr:content.json URL, which exposes additional metadata about the page.
jcr:content.json URL can be disabled on publisher instance.
 
Can you please help me to get the best way to restrict the end user to access jcr:content.json URL, and overcome from this issue at global level.
 
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by arunpatidar

Hi,

You should always do white listing not black listing of allowed pattern. That means deny everything first and allow whatever is needed e.g.

/0001 { /type "deny" /url "*" } /0017 { /type "deny" /selectors '(feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)' /extension '(json|xml|html|feed)' } /0401 { /type "allow" /url "/libs/granite/dispatcher/content/vanityUrls.html"} /0410 { /type "allow" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|pdf|png|svg|swf|ttf|woff|woff2|html)' /path "/content/myApp/*" } .... other rules

 

 

In your case you can deny jcr:content by using one of the below rule

/0402 { /type "deny" /extension 'json' /path "*(jcr:content|_jcr_content)*" } /0403 { /type "deny" /extension 'json' "*_jcr_content.json*" } /0404 { /type "deny" /extension 'json' "*jcr:content.json*" }
 

 

1 reply

arunpatidar
Community Advisor
arunpatidarCommunity AdvisorAccepted solution
Community Advisor
January 20, 2020

Hi,

You should always do white listing not black listing of allowed pattern. That means deny everything first and allow whatever is needed e.g.

/0001 { /type "deny" /url "*" } /0017 { /type "deny" /selectors '(feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)' /extension '(json|xml|html|feed)' } /0401 { /type "allow" /url "/libs/granite/dispatcher/content/vanityUrls.html"} /0410 { /type "allow" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|pdf|png|svg|swf|ttf|woff|woff2|html)' /path "/content/myApp/*" } .... other rules

 

 

In your case you can deny jcr:content by using one of the below rule

/0402 { /type "deny" /extension 'json' /path "*(jcr:content|_jcr_content)*" } /0403 { /type "deny" /extension 'json' "*_jcr_content.json*" } /0404 { /type "deny" /extension 'json' "*jcr:content.json*" }
 

 

Arun Patidar
    tushaar_srivastava
    tushaar_srivastavaAuthor
    Level 6
    January 21, 2020
    Thank you, I am very new to this concept, could you please help me where should we keep the deny or allow url rule? in dispatcher?
      Terms & ConditionsAccessibility statement

      Loading footer...