Restrict POST request from a specific SlingAllMethods...

[priyadarshi_cts]

Hi,

I have defined both doGet() and doPost() methods for SlingAllMethodsServlet as below

@Override

protected void doGet(SlingHttpServletRequest request,
SlingHttpServletResponse response) throws ServletException {

}

@Override
protected void doPost(SlingHttpServletRequest request,
SlingHttpServletResponse response) throws ServletException {

}

Why are both GET and POST requests in this servlet accessible from Postman even though sling.servlet.methods has been explicitly declared as GET  as shown below? 

@component(
service = { Servlet.class },
property = {
"sling.servlet.methods=" + HttpConstants.METHOD_GET,
"sling.servlet.paths="+ "/bin/sling/requestchecker",
},
)

[aemmarc · Accepted solution]

See : https://sling.apache.org/documentation/the-sling-engine/servlets.html

sling.servlet.methods is only applicable on registration of a servlet via sling.servlet.resourceTypes

your servlet example is registered on sling.servlet.paths