![BlogImage.jpg](https://t3.ftcdn.net/jpg/02/32/87/98/240_F_232879861_SU0eEM7kCDSA4xgGeqPqyg58XVon1qEK.jpg)
Abstract
Overview
The main way of getting an administrative session or resource resolver in AEM was using the SlingRepository.loginAdministrative() and ResourceResolverFactory.getAdministrativeResourceResolver() methods provided by Sling.
However, neither of these methods were designed around the principle of least privilege and make it too easy for a developer not to plan for a proper structure and corresponding Access Control Levels (ACLs) for their content early on. If a vulnerability is present in such a service it often leads to privilege escalations to the admin user, even if the code itself would not need administrative privileges to work.
Read Full Blog
Q&A
Please use this thread to ask the related questions.
Kautuk Sahni