Sling will have no idea how to resolve */ But what you're seeing is a non-issue, the asterisk is used as some selector in the front end and try adding a trailing / to any path it will also 403. How are you impacted by this specifically? 

There's always the release notes ---> Adobe Experience Manager 6.5.5.0 Assets provides fixes to the following issues: Start option on Create Workflow dialog for assets in a collection is disabled, thereby preventing workflow from getting triggered (NPR-32471).

Step 2 is not recommended. The CSRF Filter essentially has 5 bits of logic it will filter on 1 - request.getAuthType() != null <-- this one is super common for organizations that have their own custom servlets that omit setting the authType on the request 2 - this.isFilteredMethod(request) <-- this ...

Thanks for expanding on my understanding Jörg.

Long story short : Today in 2020 AEM is available as SaaS offering. To transform AEM from a monolithic Java application to something that runs inside orchestration containers required a series of repository restructurings that started in AEM 6.4 and furthered in 6.5.  Within this containered-AEM-wor...

What happens when NNNNN needs to be greater than 99999?Better run Compaction before the World comes to an end if that is the case. 99,999 TAR files at 256 MB per TAR is an utterly ridiculous 25 TB segmentstore size.

Re : 403 legacy api access denied. This is coming from Target. Probably better suited to field that question with them than AEM. Just going a quick skim it looks like in Nov 2017 these Target Classic legacy api's were blocked as part of TNT-27260  

The SAML response from whatever Idp you're integrating with should set what groups the user is to be added to.  The default group is just a group that you may want all users to belong to. Having a default group set is subjective to whatever the requirements are. It may not be necessary. NOTE -- the ...

RE : I am unable to compare the minified file from local js file to see any difference. What do you mean? just drop the .min off the node name and it will render the full non-minfied version of that. ORGo into the HTML Library Manager OSGI config and temporarily turn off minify while you debug. 

Direct Binary Access is how AEM moves blobs/binaries into the datastore https://jackrabbit.apache.org/oak/docs/features/direct-binary-access.html Can't answer your question specifically though since you've truncated/obfuscated much of the error. ~Marc