Rules of AEM

How to Configure CSP header in AEM ? Content Security Policy (CSP) is a security feature that helps prevent cross-site scripting (XSS) and other code injection attacks by restricting the sources from which a page can load resources. To implement a CSP header in an Apache web server, you can use the Header directive in your Apache configuration. Here are the steps to implement a CSP header in Apache: Determine your CSP policy: First, you need to determine your CSP policy. This policy defines the rules for what types of content can be loaded from which sources. You can use a CSP policy generator like the one available on the Mozilla Developer Network (MDN) website to generate a policy that meets your needs. Add the CSP header to your Apache configuration: Once you have your CSP policy, you can add the CSP header to your Apache configuration. To do this, open your Apache configuration file (usually located at /etc/httpd/conf/httpd.conf or a similar location depending on your setup) and ...

LOGGING OF THE X-FORWARDED-FOR HEADER FOR BETTER SECURITY & ATTACK MITIGATION In enterprise Adobe Experience Manager (AEM) environments, security and visibility are crucial, especially when responding to suspicious or malicious traffic patterns such as DoS or DDoS attacks. One common challenge DevOps teams face during such incidents is tracing the actual end-user IP address — especially when traffic is routed through load balancers, proxies, or CDNs. This is where the X-Forwarded-For (XFF) HTTP header becomes vital. In this blog, we’ll explore how to properly log the X-Forwarded-For header in AEM Dispatcher (both Apache and IIS) and configure debugging for better traceability. Why X-Forwarded-For Matters   The X-Forwarded-For header is widely used to preserve the original client IP address when requests pass through a proxy or load balancer. Without logging this header, access logs might only show internal IPs of the proxy, which is not helpful when analyzing or block...