Skip to content

Commit 0ff73b1

Browse files
cisbiceanubuuhuuqabasel
authored
Update default_filters.any (#1336)
* Update default_filters.any SKYOPS-135241: Introduce aem prefix for immutable farm filters to avoid naming conflicts with customer-defined configurations * chore: retrigger CI validations --------- Co-authored-by: Dirk Rudolph <drudolph@adobe.com> Co-authored-by: qabasel <qabasel@skyline-ops.ci.corp.adobe.com>
1 parent 5f992c6 commit 0ff73b1

1 file changed

Lines changed: 38 additions & 34 deletions

File tree

‎src/main/archetype/dispatcher.cloud/src/conf.dispatcher.d/filters/default_filters.any‎

Lines changed: 38 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -8,96 +8,100 @@
88

99
# deny everything and allow specific entries
1010
# Start with everything blocked as a safeguard and open things customers need and what's safe OOTB
11-
/0001 { /type "deny" /url "*" }
11+
/aem0001 { /type "deny" /url "*" }
1212

1313
# Open consoles if this isn't a production environment by uncommenting the next few lines
14-
# /002 { /type "allow" /url "/crx/*" } # allow content repository
15-
# /003 { /type "allow" /url "/system/*" } # allow OSGi console
14+
# /aem002 { /type "allow" /url "/crx/*" } # allow content repository
15+
# /aem003 { /type "allow" /url "/system/*" } # allow OSGi console
1616

1717
# allow non-public content directories if this isn't a production environment by uncommenting the next few lines
18-
# /004 { /type "allow" /url "/apps/*" } # allow apps access
19-
# /005 { /type "allow" /url "/bin/*" } # allow bin path access
18+
# /aem004 { /type "allow" /url "/apps/*" } # allow apps access
19+
# /aem005 { /type "allow" /url "/bin/*" } # allow bin path access
2020

2121
# This rule allows content to be access
22-
/0010 { /type "allow" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|pdf|png|svg|swf|ttf|woff|woff2|html|mp4|mov|m4v)' /path "/content/*" } # disable this rule to allow mapped content only
22+
/aem0010 { /type "allow" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|pdf|png|svg|swf|ttf|woff|woff2|html|mp4|mov|m4v)' /path "/content/*" } # disable this rule to allow mapped content only
2323

2424
# Enable specific mime types in non-public content directories
25-
/0011 { /type "allow" /method "GET" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|png|svg|swf|ttf|woff|woff2)' }
25+
/aem0011 { /type "allow" /method "GET" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|png|svg|swf|ttf|woff|woff2)' }
2626

2727
# Enable clientlibs proxy servlet
28-
/0012 { /type "allow" /method "GET" /url "/etc.clientlibs/*" }
28+
/aem0012 { /type "allow" /method "GET" /url "/etc.clientlibs/*" }
2929

3030
# Enable basic features
31-
/0013 { /type "allow" /method "GET" /url '/libs/granite/csrf/token.json' /extension 'json' } # AEM provides a framework aimed at preventing Cross-Site Request Forgery attacks
32-
/0014 { /type "allow" /method "POST" /url "/content/*.form.html" } # allow POSTs to form selectors under content
31+
/aem0013 { /type "allow" /method "GET" /url '/libs/granite/csrf/token.json' /extension 'json' } # AEM provides a framework aimed at preventing Cross-Site Request Forgery attacks
32+
/aem0014 { /type "allow" /method "POST" /url "/content/*.form.html" } # allow POSTs to form selectors under content
3333

34-
/0015 { /type "allow" /method "GET" /path "/libs/cq/personalization" } # enable personalization
35-
/0016 { /type "allow" /method "POST" /path "/content/*.commerce.cart.json" } # allow POSTs to update the shopping cart
34+
/aem0015 { /type "allow" /method "GET" /path "/libs/cq/personalization" } # enable personalization
35+
/aem0016 { /type "allow" /method "POST" /path "/content/*.commerce.cart.json" } # allow POSTs to update the shopping cart
3636

3737
# Deny content grabbing for greedy queries and prevent un-intended self DOS attacks
38-
/0017 { /type "deny" /selectors '(feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)' /extension '(json|xml|html|feed)' }
38+
/aem0017 { /type "deny" /selectors '(feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)' /extension '(json|xml|html|feed)' }
3939

4040
# Deny authoring query params
41-
/0018 { /type "deny" /method "GET" /query "debug=*" }
42-
/0019 { /type "deny" /method "GET" /query "wcmmode=*" }
41+
/aem0018 { /type "deny" /method "GET" /query "debug=*" }
42+
/aem0019 { /type "deny" /method "GET" /query "wcmmode=*" }
4343

4444
# Allow current user
45-
/0020 { /type "allow" /url "/libs/granite/security/currentuser.json" }
45+
/aem0020 { /type "allow" /url "/libs/granite/security/currentuser.json" }
4646

4747
# Allow index page
48-
/0030 { /type "allow" /url "/index.html" }
48+
/aem0030 { /type "allow" /url "/index.html" }
4949

5050
# Allow IMS Authentication
51-
/0031 { /type "allow" /method "GET" /url "/callback/j_security_check" }
51+
/aem0031 { /type "allow" /method "GET" /url "/callback/j_security_check" }
5252

5353
# AEM Forms specific filters
5454
# to allow AF specific endpoints for prefill, submit and sign
55-
/0032 { /type "allow" /path "/content/forms/af/*" /method "POST" /selectors '(submit|internalsubmit|agreement|signSubmit|prefilldata|save|analyticsconfigparser)' /extension '(jsp|json)' }
55+
/aem0032 { /type "allow" /path "/content/forms/af/*" /method "POST" /selectors '(submit|internalsubmit|agreement|signSubmit|prefilldata|save|analyticsconfigparser)' /extension '(jsp|json)' }
5656

5757
# to allow AF specific endpoints for thank you page
58-
/0033 { /type "allow" /path "/content/forms/af/*" /method "GET" /selectors '(guideThankYouPage|guideAsyncThankYouPage)' /extension '(html)'}
58+
/aem0033 { /type "allow" /path "/content/forms/af/*" /method "GET" /selectors '(guideThankYouPage|guideAsyncThankYouPage)' /extension '(html)'}
5959

6060
# to allow AF specific endpoints for lazy loading
61-
/0034 { /type "allow" /path "/content/forms/af/*" /method "GET" /extension '(jsonhtmlemitter)'}
61+
/aem0034 { /type "allow" /path "/content/forms/af/*" /method "GET" /extension '(jsonhtmlemitter)'}
6262

6363
# to allow fp related functionalities
64-
/0035 { /type "allow" /path "/content/forms/*" /selectors '(fp|attach|draft|dor|api)' /extension '(html|jsp|json|pdf)' }
64+
/aem0035 { /type "allow" /path "/content/forms/*" /selectors '(fp|attach|draft|dor|api)' /extension '(html|jsp|json|pdf)' }
6565

6666
# to allow forms access via dam path
67-
/0036 { /type "allow" /path "/content/dam/formsanddocuments/**/jcr:content" /method "GET"}
67+
/aem0036 { /type "allow" /path "/content/dam/formsanddocuments/**/jcr:content" /method "GET"}
6868

6969
# to allow invoke service functionality (FDM)
70-
/0037 { /type "allow" /path "/content/forms/*" /selectors '(af)' /extension '(dermis)' }
70+
/aem0037 { /type "allow" /path "/content/forms/*" /selectors '(af)' /extension '(dermis)' }
7171

7272
# to allow forms portal draft and submissions component operation servlet
73-
/0038 { /type "allow" /path "/content/*" /method "GET" /selectors '(fp)' /extension '(operation)' }
73+
/aem0038 { /type "allow" /path "/content/*" /method "GET" /selectors '(fp)' /extension '(operation)' }
7474

7575
# AEM Screens Filters
7676
# to allow AEM Screens channels selectors
77-
/0050 { /type "allow" /method "GET" /url "/screens/channels.json" }
77+
/aem0050 { /type "allow" /method "GET" /url "/screens/channels.json" }
7878

7979
# to allow AEM Screens Content and selectors
80-
/0051 { /type "allow" /method '(GET|HEAD)' /url "/content/screens/*" }
80+
/aem0051 { /type "allow" /method '(GET|HEAD)' /url "/content/screens/*" }
8181

8282
# AEM Sites Filters
8383
# to allow site30 theme servlet
84-
/0052 { /type "allow" /extension "theme" /path "/content/*" }
84+
/aem0052 { /type "allow" /extension "theme" /path "/content/*" }
8585

8686
# Allow manifest.webmanifest files located in the content
87-
/0053 { /type "allow" /extension "webmanifest" /path "/content/*/manifest" }
87+
/aem0053 { /type "allow" /extension "webmanifest" /path "/content/*/manifest" }
8888

8989
# Allow Apache Sling Sitemap selectors: sitemap, sitemap-index, sitemap.any-nested-or-named-sitemap
90-
/0054 { /type "allow" /method "GET" /path "/content/*" /selectors 'sitemap(-index)?' /extension "xml" }
90+
/aem0054 { /type "allow" /method "GET" /path "/content/*" /selectors 'sitemap(-index)?' /extension "xml" }
9191

9292
# Allow GraphQL & preflight requests
9393
# GraphQL also supports "GET" requests, if you intend to use "GET" add a rule in filters.any
94-
/0060 { /type "allow" /method '(POST|OPTIONS)' /url "/content/_cq_graphql/*/endpoint.json" }
94+
/aem0060 { /type "allow" /method '(POST|OPTIONS)' /url "/content/_cq_graphql/*/endpoint.json" }
9595

9696
# GraphQL Persisted Queries & preflight requests
97-
/0061 { /type "allow" /method '(GET|POST|OPTIONS)' /url "/graphql/execute.json*" }
97+
/aem0061 { /type "allow" /method '(GET|POST|OPTIONS)' /url "/graphql/execute.json*" }
9898

9999
# Allow Adaptive Form & Document Services requests
100-
/0062 { /type "allow" /method '(GET|POST|OPTIONS)' /url "/adobe/forms/*" }
100+
/aem0062 { /type "allow" /method '(GET|POST|OPTIONS)' /url "/adobe/forms/*" }
101101

102102
# Allow PUT for Forms DocAssurance Services Decryption API
103-
/0063 { /type "allow" /method "PUT" /url "/adobe/forms/document/assure/encrypt" }
103+
/aem0063 { /type "allow" /method "PUT" /url "/adobe/forms/document/assure/encrypt" }
104+
105+
# Allow Sites Content Fragment Delivery API (read-only + CORS preflight; see SITES-42114)
106+
/aem0064 { /type "allow" /method '(GET|HEAD|OPTIONS)' /url "/adobe/contentFragments" }
107+
/aem0065 { /type "allow" /method '(GET|HEAD|OPTIONS)' /url "/adobe/contentFragments/*" }

0 commit comments

Comments
 (0)