Referrer Filter referrer-filter

Adobe Experience Manager’s Referrer Filter enables access from third-party hosts.

An OSGi configuration for the Referrer Filter is needed to enable access to the GraphQL endpoint for headless applications over HTTP POST. When using AEM Headless Persisted Queries which access AEM over HTTP GET, a Referrer Filter configuration is not needed.

This is done by adding an appropriate OSGi configuration for the Referrer Filter that:

The name of the file must be org.apache.sling.security.impl.ReferrerFilter.cfg.json.

For example, to grant access for requests with the Referrer my.domain you can:

{
    "allow.empty": false,
    "allow.hosts": [
      "my.domain"
    ],
    "allow.hosts.regexp": [
      ""
    ],
    "filter.methods": [
      "POST",
      "PUT",
      "DELETE",
      "COPY",
      "MOVE"
    ],
    "exclude.agents.regexp": [
      ""
    ]
}