AEM6.4.1: Block OPTIONS method call in an aem instance | Community
Skip to main content
nagaseran
Level 2
Aug 5, 2019 1:41 PM UTC

AEM6.4.1: Block OPTIONS method call in an aem instance

Hi Team,

We got an security issue on aem instance/server saying that our aem instance is allowing OPTIONS method calls and we need to disable that. Could you please help on this (Issue is specific to aem author/publish)

Thanks

Seran.

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

    7 replies

    anujg3325839
    anujg3325839
    Employee
    Aug 6, 2019 9:23 AM UTC

    Hi Seran, you can try  putting the deny method filters at the END of the filter section in your dispacther.any file

    ... all other filters ...

    /1020 { /type “deny" /method "TRACE" /url "*" }

    /1025 { /type “deny" /method "OPTIONS" /url "*" }

    }

    Translate
      nagaseranAuthor
      Level 2
      Aug 6, 2019 9:40 AM UTC

      Hi Anuj,

      Thanks for the inputs. We want to block OPTIONS HTTP method on author & publish server. The issue is already addressed on our dispatcher server.

      Thanks

      Seran

      Translate
      arunpatidar
      arunpatidar
      New Participant
      Aug 5, 2019 4:11 PM UTC

      One way is blocking from “Apache Sling Referrer Filter”

      http://localhost:4504/system/console/configMgr/org.apache.sling.security.impl.ReferrerFilter

      • Filter Methods (String[]): defines which HTTP method(s) will be checked with the values in the allowed hosts before accepting incoming HTTP requests.
      Translate
      Arun Patidar
      nagaseranAuthor
      Level 2
      Aug 6, 2019 9:07 AM UTC

      Hi Arun,

      Thanks for the inputs. I added "OPTIONS" method in “Apache Sling Referrer Filter” and tried below curl command. It is showing as allowed.

      Curl Cmd: curl -i -X OPTIONS http://localhost:4503

      Response:

      HTTP/1.1 200 OK

      Date: Tue, 06 Aug 2019 09:02:56 GMT

      X-Content-Type-Options: nosniff

      X-Frame-Options: SAMEORIGIN

      Allow: OPTIONS, TRACE, GET, HEAD

      Content-Length: 0

      Thanks

      Seran

      Translate
      arunpatidar
      arunpatidar
      New Participant
      Aug 6, 2019 10:24 AM UTC

      Hi,

      I tried same on vanilla AEM instance with any config changes, I get below:

      Translate
      Arun Patidar
        Terms & ConditionsAccessibility statement

        Loading footer...