Search code examples
aemsling

Why AEM returns 403 for requests without extensions?

By default all the GET requests go to DefaultGetServlet first. Based on the extension, it delegates the request to renderers. Now, if there is no extension in the request URI, why AEM sends 403 (Forbidden) ? At the most, if AEM is unable to serve this, it may send a BAD REQUEST instead. AEM sends 403 even if you are logged in as an admin user (Which has highest level of authorization, if that helps).

Example:

http://localhost:4502/content/geometrixx/en/events

this URL will be responded with 403. Whereas 

http://localhost:4502/content/geometrixx/en/events.html

will be served without any problems.

Solution

  • Adding to the above, as mentioned by Ahmed: With the URL "http://localhost:4502/content/geometrixx/en/events" StreamRendererServlet will get executed and resolves to redirect logic ending with /.

    // redirect to this with trailing slash to render the index
String url = request.getResourceResolver().map(request,resource.getPath())+ "/";
response.sendRedirect(url);

    Once redirected to "http://localhost:4502/content/geometrixx/en/events/" The same StreamRendererServlet resolves to directory listing logic.

    // trailing slash on url means directory listing
if ("/".equals(request.getRequestPathInfo().getSuffix())) {
  renderDirectory(request, response, included);
  return;
}

    In the renderDirectory as indexing will be false,

    if (index) {
  renderIndex(resource, response);
} else {
  response.sendError(HttpServletResponse.SC_FORBIDDEN);
}

    a 403 Forbidden response will be sent.

    You can change this behavior by enabling "Auto Index" for "Apache Sling GET Servlet" felix configuration console.