Servlet as resource type works in DEV Publish but not in Stage Publish - AEM as a Cloud Service

[JoelSo3]

I’m facing an issue where a servlet configured as a resource type  works perfectly fine in the DEV publish environment, but it doesn’t work as expected in the Stage publish environment. The servlet is registered correctly, and I’ve confirmed it’s being picked up in DEV, but in Stage, it seems to fail silently—no errors in the logs that I can pinpoint yet.I'm using AEM as a Cloud Service.

ui.content\src\main\content\jcr_root\content\tap\servlets\search\.content.xml

core\src\main\java\com\flytap\core\servlets\SearchTapServlet.java

dispatcher\src\conf.dispatcher.d\filters\filters.any

https://publish-stage-env.adobeaemcloud.com/content/tap/servlets/search/jcr:content.json?text=bagagem&lang=pt&page=1&hitsPerPage=10&filter=all  

When I execute this call in the browser I get a 404.

Do I need to do any more configurations?

[Anil_Chennapragada]

hi @JoelSo3 ,

In the above case, I believe you have introduced a custom resource type and included that in the ui.content module. 

1. Can you please check in the filter.xml if you have allowed the path /content/tap/servlets path
2. Please check if the dispatcher config Id "0999" is not being used elsewhere.
3. Also, Why do we have to call it "/content/tap/servlets/search/jcr:content.json". you can call it directly like "/content/tap/servlets/search.json" or include some selector and call it like /content/tap/servlets/search.<selector>.json. Generally jcrcontent.json would be denied in the dispatchers

Thanks,

Anil

[kautuk_sahni]

@MukeshYadav_ @AmitVishwakarma @Manu_Mathew_ @martin_ecx_io @ayush-804 @Dipti_Chauhan @pulkitvashisth @narayana_chirra @smithchar This question could use some expert insight—would love to hear your thoughts if you can take a look!

[giuseppebag · Accepted solution]

hi @JoelSo3,

have you verified whether the servlet is functioning correctly when accessed directly from the environment IP?

Additionally, I recommend defining a custom selector for that servlet. Relying on the generic JSON extension can be risky, as noted in the Security Checklist on the page. It could potentially lead to injection attacks, cross-site scripting, and denial of service issues.

The dispatcher's best practices are:

1. Deny access to everything by default.
2. Allow access to specific content as needed.

This means a generic request with the JSON extension (like /content/tap/servlets/search/jcr:content.json) would be blocked.

[JoelSo3]

I added a custom selector to my servlet and changed the extension to .html and I no longer have problems in the stage publish.

@SlingServletResourceTypes(

        resourceTypes="tap/search",

        methods= "GET",

        extensions="html",

        selectors ="search"

)

publish-stage-env.adobeaemcloud.com/content/tap/servlets/search.html?text=bagagem&lang=pt&page=2&hitsPerPage=20&filter=all 

publish-stage-env.adobeaemcloud.com/content/tap/servlets/search.search.html?text=bagagem&lang=pt&page=2&hitsPerPage=20&filter=all 

Now I can call my servlet with and without selector and it works properly.

Thank you for the help!