Suggestion to block children and home endpoints in AEM

[AnushaAt]

Hi Team,

We received a vulnerabilities ticket, mentioning to block children,childrenlist and home.json endpoints. 

Whenever we are hitting www.abc.com/content/*/*/*.children.json , we are able to see json files loading. so we added the deny rule in publish.ehs.any file

/0012 {
/url "/childrenlist.json"
/type "deny"
}
/0013 {
/url "/children.json"
/type "deny"
}

but still the json files are loading . so It will be helpful if we get any suggestions to block the endpoints. 

Regards,

Anusha
 

[manikandan90]

Hi @AnushaAt 

Add the filter condition like blow in you dispatcher filter.any file.

{ /type "deny" /suffix '(.*infinity.*|.*children.*|.*tidy.*)' }