In a client's test environment AEM QA Testers from multiple groups and regions are testing and making requests to the AEM application. Due to the sheer number of hosts making connections, an…

The correct answer is A. Add GET as a Filter Method in the Apache Sling Referrer OSGi Configuration. Option A is correct because the Apache Sling Referrer Filter is AEM's CSRF protection layer that validates the Referrer header on incoming requests. Adding GET to the Filter Methods configuration instructs the filter to permit GET requests from any originating host without…

Design and Architecture

Question

In a client's test environment AEM QA Testers from multiple groups and regions are testing and making requests to the AEM application. Due to the sheer number of hosts making connections, an Architect needs a quick and easy way to allow any hosts to make requests to the AEM application. Which approach should the Architect take to meet this requirement for this non- production environment?

Options

AAdd GET as a Filter Method in the Apache Sling Referrer OSGi Configuration
BUse Allowlists instead of Blocklists in the Dispatcher Configuration
CRestrict Clients that can flush the cache in the Dispatcher Configuration
DEnable Allow Empty in the Apache Sling Referrer OSGi Configuration

How the community answered

(58 responses)

A
72% (42)
B
16% (9)
C
3% (2)
D
9% (5)

Explanation

Option A is correct because the Apache Sling Referrer Filter is AEM's CSRF protection layer that validates the Referrer header on incoming requests. Adding GET to the Filter Methods configuration instructs the filter to permit GET requests from any originating host without referrer validation - a single OSGi config change that immediately opens access for all QA hosts in a non-production environment without needing to enumerate every tester's IP or hostname.

Option B is wrong because Dispatcher allowlists vs. blocklists control URL/path-based request filtering at the web-server tier, not cross-host access to the AEM application itself. Option C is a red herring - restricting cache flush clients governs who can invalidate the Dispatcher cache, which has nothing to do with allowing application requests from multiple hosts. Option D (Enable Allow Empty) only permits requests that have no Referrer header at all (e.g., direct API calls from command-line tools); it does not help browser-based QA testers who send a Referrer from an unlisted host, making it an incomplete solution.

Memory tip: Think of it as "filter the method, not the host" - in a non-prod environment with too many hosts to list, controlling access at the HTTP method level (GET) is the quick, scalable workaround. If you see "any hosts + quick solution + non-production," look for the Sling Referrer Filter's method-level configuration, not Dispatcher rules.

Topics

#Apache Sling Referrer Filter#AEM Security Configuration#Request Validation#Non-Production Environment Design

Community Discussion

No community discussion yet for this question.

Full AD0-E117 Practice