AEM Publish CORS & Dispatcher Setup

Configure AEM Cloud publish so Download List and Search blocks work on aem.live and aem.page. The delivery site runs on EDS; blocks fetch DAM metadata and files from your publish instance. That requires dispatcher allow rules and a Granite CORS policy on publish, plus hostname in the EDS site.

Why this is needed

• On author, same-origin requests to AEM work without CORS.
• On aem.live / aem.page, the browser calls publish-….adobeaemcloud.com cross-origin.
• Without CORS + dispatcher, folder listings and asset metadata return 404 or fail CORS checks.

EDS site prerequisite

• Set hostname in placeholders.json or page metadata to your author URL (e.g. https://author-pXXXX-eYYYY.adobeaemcloud.com). Blocks derive the publish URL from it.

Publish endpoints used by blocks

• Download List: /content/dam/….json, /api/assets/….json, asset file GET for download
• Search (asset folder): recursive /content/dam/….N.json on publish
• Search (optional): /bin/readpdf?keyword=… only if that servlet exists in your AEM project

Option A — Deploy RefDemoEDS-Backend (recommended)

• Repository: https://github.com/AEMXSC/RefDemoEDS-Backend
• Optional AEM package with CORS and dispatcher rules preconfigured for Reference Demo 2.0.
• Connect the repo to AEM Cloud Service and run the Cloud Manager pipeline to author and publish.
• Includes: ui.config CORS policy (refdemoeds) and dispatcher filters /0110, /0111 plus CORS client headers.
• Does not include /bin/readpdf; PDF full-text search needs a custom servlet if required.

Option B — Manual configuration in your AEM project

• CORS: Add com.adobe.granite.cors.impl.CORSPolicyImpl config on publish. Allow origins: *.aem.live, *.aem.page (and preview hosts). Allowed paths: /api/assets/*, /content/dam/*.json, depth JSON patterns. Methods: GET, HEAD, OPTIONS.
• Dispatcher filters.any: Allow GET|HEAD|OPTIONS on /content/dam/* extension json; allow /api/assets/*.
• Dispatcher clientheaders.any: Forward Origin and Access-Control-Request-* headers.
• Deploy via Cloud Manager so publish CDN receives the updated dispatcher config.
• Optional: allow /bin/readpdf in dispatcher and CORS if PDF text search is deployed.

Verification

• curl publish URL /content/dam/{folder}.1.json → HTTP 200
• Same request with Origin: https://your-site.aem.live → Access-Control-Allow-Origin present
• Browser: Download List and Search (with Asset Search Path) load assets on aem.live