如何保护AEM 6.5中无头架构中的AEM页面和资产
我在AEM中有一些内容，我计划以无头的方式将这些内容导出到移动应用程序（React）中。我使用AEM内容作为服务，吊索内容出口商（Jackson）导出内容。
例如，http：// localhost：4502/pontent/we-retail/language-masters/en/course.model.model.json将导出一些内容到frontend应用程序（React Mobile App）。我想保护此API调用，我应该将JSON响应仅返回我的前端应用程序（React Mobile App），
我想验证谁在调用AEM。在这种情况下，我只想允许移动（React）致电AEM并希望拒绝所有其他人。如何保护我的AEM内容？
我想的一种方式是在AEM中使用 Apache Sling转介滤波器。如果我们不允许在“允许主机”中使用移动应用程序（REECT），则推荐人过滤器将拒绝请求。这是正确的处理方式吗？如果还有其他最佳方法来处理此问题吗？使用Adobe Granite OAuth 2.0服务器怎么样？
请建议我什么可用的选择来保护无头的内容。
I have some content in AEM and I am planning to export those content into mobile app(react) in headless way. I am using AEM content as service, sling content exporter(Jackson) to export the content.
For example, http://localhost:4502/content/we-retail/language-masters/en/course.model.json will export some content to frontend application(react mobile app). I want to protect this API call and I should return the json response only to my frontend application(react mobile app)
Basically I want to validate who is calling AEM. In this case I want to allow only mobile(react) to call AEM and want reject all others. How do I protect my AEM content ?
The one way I am thinking is to use Apache sling referrer filter in AEM. Referrer filter will reject the request if we are not allowing the mobile app (react ) in "Allow Host". Is this correct way to handle? if there any other best way to handle this? how about using Adobe granite OAuth 2.0 server ?
Please suggest me what are the available option to protect the content in headless.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当您将应用程序放弃时（并且基于JavaScript），您将无法获得完全的安全性。攻击者可以使用越狱手机并进行调试或删除您的应用程序。但是您可以轻松地以某种方式保护您的API，没有人可以“注意”找到入口。平均黑客无法访问。
简单的方法= SSL +基本验证
确保仅通过HTTPS（= SSL）访问您的网站。然后只需添加一个基本的验证密码，这很难猜测。这很容易实现（在调度程序和应用程序中），开发人员/运营商仍然可以测试API。只能确保在您的应用中使密码混淆。因此，不要将其存储为纯文本。简单的XOR加密可能就足够了。
Advanced方法=带有客户端认证的SSL
而不是基本的验证密码，您可以使用SSL客户端证书（也可以在调度程序上实现，而不是在AEM中实现）。这可能有点过分设计，并且仍然会丢失。但是现在，攻击者必须将您的应用程序解释以提取证书。理论上可以通过其他方式“找到”基本的auth密码，也可以用蛮力攻击。
PS：在这两种情况下，您都需要通过一些入侵检测来监视API。而且，您必须能够向合法客户端分发新密码或客户端证书。
PPS：移动安全是一个重要的话题。这无法在堆叠问题中处理。但是，要阻止脚本 - kiddies爬上API，简单的方法可能足够好。
As you give the App away (and it is based on JavaScript), you cannot get full security. Attackers could use a jailbroken phone and debug or de-compile your app. But you can easily secure your API in a way, that nobody can “accidently” find the entrance. Nor the average hacker can gain access.
The simple approach = SSL + Basic Auth
Make sure, that your site is only accessible via https (= SSL). Then just add a Basic Auth password, which is hard to guess. This is simple to implement (on Dispatcher and in the App), and developers/operators could still test the API. Only make sure, that the password is obfuscated in your App. So, don’t store it as plain text. A simple XOR encryption is probably enough.
The advanced approach = SSL with client-certificates
Instead of a Basic Auth password, you could use an SSL client certificate (implement that also on the Dispatcher, and NOT in AEM). This is probably a little bit over-engineered, and it can still get lost. But now the attacker must de-compile your App to extract the certificate. The Basic Auth password could theoretically be “found” in other ways – or it could be attacked with brute force.
PS: In both cases you need to monitor your API with some intrusion detection. And you must be able to distribute new passwords or client certificates to legitimate clients.
PPS: Mobile Security is a huge topic. This could not be handled in a StackOverflow question. But to stop script-kiddies from crawling your API, the simple approach is probably good enough.