Question about servlet domain when interacting with an api

[DanielMa63]

Greetings,
For security reasons, our client has asked us to add the header "Access-Control-Allow-Origin" with a list of our sites domains.
But i specifically was wondering about one particular aspect of api intengration.
We use AEMAACS

So in our case, we call an internal sevlet, from which we then call the api, will attach some snippets as a visual example.

When the api receives our request in that case, is the sender the domain from which we called the servlet initially www.example.com or is it the domain of our specific adobe servlet.

Thanks in Advance!

Best Regards,

Daniel

[VishalKa5 · Accepted solution]

Hi @DanielMa63 ,

You have a website like www.example.com, and on that site, you trigger a call to a custom servlet inside AEM. That servlet then talks to your backend API.

Now, your client asked to add an Access-Control-Allow-Origin header to allow only certain website domains to call the API.

But here’s the key point:

The API is not being called directly by the browser (www.example.com).
Instead, it’s being called by the AEM server itself (from the servlet code).

So when the API receives the request, it doesn’t know or care about www.example.com — it only sees that AEM is making the call.

So what does this mean?

• The domain seen by the API is AEM’s domain, not your site’s domain.

• The CORS header (Access-Control-Allow-Origin) is only needed when the browser directly calls the API – and that’s not happening here.

• In your case, the API should allow calls from AEM, not from www.example.com.

Bottom line:

Even though your user is on www.example.com, the API only sees AEM as the caller — not the browser. So, the client should allow AEM’s server in their rules, not your site’s domain.

Thanks & Regards,

Vishal

[DanielMa63]

Yes, thanks for the response, it resolves my doubt!

[SantoshSai]

Hi @DanielMa63,

Based on your code and description, here is what I understood:

• You have an internal servlet (DruidLoginServlet) hosted within AEMaaCS.

• That servlet makes an outbound call to an external API using a method like callApiDruidGet(...) via HttpClient.

• The frontend (eg. www.example.com) makes a request to your servlet.

• That servlet then calls the external API.

When your AEM servlet (on AEMaaCS) sends a request to the API from the backend, the origin of the request (from the API’s point of view) is AEMaaCS's server infrastructure, not the original browser/client (ie. not www.example.com).

More precisely:

• The Origin or Referer headers that an external API sees will typically be those of AEMaaCS, unless:

  • You manually forward the original headers from the client

  • Or the client sends the request directly to the API (not your servlet)

Access-Control-Allow-Origin: This header is only relevant in responses from the API to the browser, not in requests.

Here’s how it works:

• If a browser makes a cross-origin AJAX call, the API response must include the correct Access-Control-Allow-Origin to allow it.

• But in your case, the browser is not calling the API; your AEM backend is.

So the external API does not need to return CORS headers (like Access-Control-Allow-Origin) unless the frontend itself directly calls the external API from the browser.

Is that what you are trying to understand in your original request?

[DanielMa63]

Yes that is what i was wondering, thanks!