DocumentationExperience Cloud KCS

AEM as a Cloud Service: Prevent repository metadata exposure in error responses

Last update: July 30, 2026

This article explains how to resolve an issue in Adobe Experience Manager as a Cloud Service where custom error handler configurations expose repository metadata in error responses. The solution involves updating the error handler to ensure error pages are rendered as HTML.

Description description

Environment

Adobe Experience Manager as a Cloud Service (AEMaaCS)

Symptoms

Error responses handled by a custom error handler expose repository metadata, such as jcr:primaryType, jcr:createdBy, and jcr:created, especially when the error handler includes a maintenance error page without specifying the .html extension. This occurs when a request to a legacy servlet path (fFor example: /bin/wcm/search/gql.servlet.json) returns a 404 errorand is processed by a custom error handler JSP (such as /apps/sling/servlet/errorhandler/default.jsp).

Cause

If the error handler includes a maintenance error page without the .html extension, the response inherits the original request’s extension (such as .json), resulting in repository metadata being serialized into the response body. No credentials or sensitive business data are exposed, but this increases the risk of information disclosure.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Open your project codebase and locate the custom error handler JSP file, typically found at /apps/sling/servlet/errorhandler/default.jsp.

  2. Identify the lines where the maintenance error page is included. These may look like:

    <jsp:include page="/content/<your-site>/maintenance/maintenance-error" />

  3. Update each include statement to explicitly specify the .html extension. For example:

    <jsp:include page="/content/<your-site>/maintenance/maintenance-error.html" />

  4. Save your changes and deploy the updated code to your AEM as a Cloud Service environment using your standard deployment process.

  5. Verify the fix by accessing the affected endpoint(s) (such as /bin/wcm/search/gql.servlet.json) and confirm that error responses no longer expose repository metadata and are rendered as HTML error pages.

recommendation-more-help
experience-cloud-kcs-help-kbarticles