Servlet using resourceType

[Keerthi0555]

Servlet using resourceType when we get resourceResolver by request how secure the servlet is if we get resourceResolver by request and request has what user permissions?

[lukasz-m · Accepted solution]

Hi @Keerthi0555,

Assuming you're getting resourceResolver like below:

request.getResourceResolver();

The permission level will depend on the user that you are currently logged in, if you are not logged in than permission set of Anonymous user will be used.

[SreenivasBr]

1. How secure the servlet is - It depends on what access the node which has that resoucetype, has.

2. Request has what user permissions - The permissions of the user who is accessing that node, which triggered this servlet.

[BrianKasingli]

A servlet using resourceType and obtaining a ResourceResolver via request.getResourceResolver() operates with the permissions of the user tied to the request. This ensures actions are constrained by the user's permissions (public users will be anonymous user), adhering to AEM's security model. The servlet inherently inherits the user's access scope, making it as secure as the requesting user's permissions. However, risks arise if the servlet doesn't validate or sanitize inputs properly, potentially exposing sensitive operations or data. To maintain security, ensure the servlet implements robust input validation, adheres to the principle of least privilege, and limits actions to only what is necessary for the servlet's purpose.

anonymous user or everyone group typically can read nodes in the repository based on the permissions granted to the everyone group. If this user calls the servlet, and the request is adapting to the ResourceResolver object, the everyone group typically has no write permissions

[Anudeep_Garnepudi]

If the servlet is called from author, then will have current logged-in user permissions.
If it called from publish(live site), then will only have read access to /content