If you are running server-side code to push this information over to Analytics or some other back end system, then I would agree with Brian's post here.  Sling models are generally for representing a JCR resource that correlates with a page component.  An OSGi service is going to provide you access ...

Ok, sounds good, thanks!

Hey Joerg, I definitely thought of that, but disabling JSON rendering in the Apache Sling GET Servlet breaks other OOTB functionalities related to personalization where calls to `/home/users/X/XXXXXXXXX.infinity.json` based on the current user are used.

vipins5188​ What is the purpose of the sling filter pattern of `/libs/wcm/core/content/pageinfo.json`?  The JSON I believe comes from the Apache Sling GET Servlet which listens to "resource type" of `sling/servlet/default` - should the filter be more broad to capture all requests that would be handl...

Thanks @andyshreve I completely agree with you on the point about blocking content grabbing.  My confusion is that the rule that Adobe docs provide is insufficient to do so.  There are some selectors you have above that are not covered by it.  And though the rule blocks the .feed. selector, it does ...

Thanks vipins5188​ I'll take a look at your solution and see if that will be a clean solve.  I'd rather do this if possible rather than require all JSON requests to have a whitelisted selector since the latter seems arbitrary.It does raise a question, however, about why Adobe doesn't solve this issu...

Heh thanks kunal23​ I do realize we could technically use a custom selector to get around the issue of whitelisting.  It's definitely a workable solution, and thus I appreciate you confirming.That said, given that this is a security issue, shouldn't AEM have a solution that doesn't require custom de...

In AEM we generally block all `page.infinity.json` and `page.N.json` requests, as it allows content grabbing and reveals internal node structure including usernames or anything else that might be considered "internal". However, page.json requests (no selector) seem to also render their JSON contents...

Reference Adobe Docs at: Configuring Dispatcher AEM docs have a rule that “prevents content grabbing” where the feed selector is prevented for extensions json, xml, and html.# Deny content grabbing for /content and its subtree/0082 { /type "deny" /path "/content/*" /selectors '(feed|rss|pages|langua...

Thanks for the confirmation KBWEB​.  This kinda of stuff makes me angry, because the features give an impression that clients can do a certain thing with the platform, but in reality (due to normal, practical reasons) they cannot.  These features have been around long enough that they should be more...