Restrict JSON file in dam path Access-Control-Allow-Origin to www.mydomain.com instead of complete *

[sane]

Hi All,

I want to restrict the json coming from /content/dam/application/ to www.mydomain.com domain instead of a wildcard.

i want Restrict JSON file in dam path Access-Control-Allow-Origin to www.mydomain.com instead of complete *

Could you please help here 

[SantoshSai]

Hi @sane,

You can control the CORS header Access-Control-Allow-Origin for DAM JSON responses using the AEM Dispatcher or CDN layer. AEM itself does not set CORS for assets, so you need to configure it at the web tier.

How to restrict JSON under /content/dam/application/ to a specific domain:

Dispatcher (Apache)

Add a rewrite rule inside your vhost or rewrite rules:

<IfModule mod_headers.c>
    <LocationMatch "^/content/dam/application/.*\.json$">
        Header unset Access-Control-Allow-Origin
        Header set Access-Control-Allow-Origin "https://www.mydomain.com"
    </LocationMatch>
</IfModule>

This will override the default * and only allow your domain.

OR

AEM as a Cloud Service

If you're on AEMaaCS, you must configure CORS through the Dispatcher clientheaders.any + CDN layer, not directly in AEM.

Add a rule inside dispatcher/src/conf.d/cors/*.conf (or create a custom one):

<LocationMatch "^/content/dam/application/.*\.json$">
    Header unset Access-Control-Allow-Origin
    Header set Access-Control-Allow-Origin "https://www.mydomain.com"
</LocationMatch>

Then make sure the domain is declared in CORS Allowed Origins in Cloud Manager → Environments → Edit → CORS configuration.

Important Notes

• AEM does not allow you to configure CORS per path inside OSGi configurations.

• Path-based CORS control must be done in the web tier (Dispatcher / CDN).

• Use LocationMatch so only JSON files under that DAM path get the domain restriction.

[muskaanchandwani · Accepted solution]

Hello @sane 

For AEMaaCS, this can be done at the CDN level using the CDN configuration pipeline and a response transformation rule that overrides Access-Control-Allow-Origin for the specific DAM path.

Example CDN config: set Access-Control-Allow-Origin: https://www.mydomain.com for JSON assets under /content/dam/application/ on stage/prod.

kind: "CDN"
version: "1"
metadata:
  envTypes: ["stage", "prod"]
data:
  responseTransformations:
    rules:
      - name: dam-json-cors
        when:
          allOf:
            # Limit to DAM JSON under /content/dam/application/
            - reqProperty: path
              matches: "^/content/dam/application/.*\\.json$"
        actions:
          - type: set
            respHeader: Access-Control-Allow-Origin
            value: "https://www.mydomain.com"

Place this cdn.yaml under your repository’s config/ folder and deploy via a Config Pipeline.
The set action on respHeader overrides the existing * value coming from the DAM/Blob stack.

Reference :

https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/implementing/con...