Expand my Community achievements bar.

SOLVED

Enabling QueryBuilder on Publish Server:Key consideration and Authentication on Adobe Cloud Server

Avatar

Level 4
Level 4

Hi All, 

We have a requirement to enable Querybuilder URL[1] on the publish server. 

 

https://localhost:4502/bin/querybuilder.json?p.guessTotal=true&p.limit=10&path=%2fcontent%2fdam&prop...

 

Before procedding with the enablement,it is important to understand the key considerations that need to be taken into account. 

Is it necessory to implement any authentication mechanism for querybuilder. 

 

Can you please share your valueble inputs on the subject?

 

Environment - Adobe Cloud Services

 

 

 

 

1 Accepted Solution

Avatar

Correct answer by
Community Advisor

Hello @nj2 

 

Opening querybuilder can easily increase your chances of attacks.

 

1. One could generate any number of queries affecting your system.

2. If one queries on a param which is not indexed, it will affect the performance of the system.

3. One can know the entire structure of the site by firing queries.

4. Large queries will have further impact to the system

 

 

 


Aanchal Sikka

View solution in original post

2 Replies

Avatar

Correct answer by
Community Advisor

Hello @nj2 

 

Opening querybuilder can easily increase your chances of attacks.

 

1. One could generate any number of queries affecting your system.

2. If one queries on a param which is not indexed, it will affect the performance of the system.

3. One can know the entire structure of the site by firing queries.

4. Large queries will have further impact to the system

 

 

 


Aanchal Sikka

Avatar

Employee Advisor

Hi,

 

In Adobe Cloud Services, additional authentication mechanisms may be required to enable the Querybuilder URL on the publish server. This is because the Querybuilder exposes sensitive information about the content structure and properties of your AEM instance. Implementing proper authentication and authorization mechanisms, such as configuring user credentials or integrating with an identity provider, can help ensure that only authorized users can access the Querybuilder API and protect sensitive information.