Enable asset download servlet
The default servlet in Experience Manager allows authenticated users to issue arbitrarily large, concurrent download requests for creating ZIP files of assets visible to them that can overload the server and the network. To mitigate potential DoS risks caused by this feature, AssetDownloadServlet
OSGi component is disabled by default for publish instances.
To allow downloading assets from your DAM, say when using something like Asset Share Commons or other portal-like implementation, manually enable the servlet by way of an OSGi configuration. Adobe recommends setting the permissible download size as low as possible without affecting the day-to-day download requirements. A high value may impact performance.
-
Create a folder with a naming convention that targets the publish runmode (
config.publish
):/apps/<your-app-name>/config.publish
. To define configuration properties for a run mode, see Run Modes. -
In the configuration folder, create a file of type
nt:file
namedcom.day.cq.dam.core.impl.servlet.AssetDownloadServlet.config
. -
Populate
com.day.cq.dam.core.impl.servlet.AssetDownloadServlet.config
with the following. Sets a maximum size (in bytes) for the download as value ofasset.download.prezip.maxcontentsize
. The below sample configures the maximum size of the ZIP download to not exceed 100 kb.enabled=B"true" asset.download.prezip.maxcontentsize=I"102400"
By default, for GET
requests to download files, Experience Manager enforces a 50 MB limit on the ZIP archive’s download size. Downloads initiated via POST
requests or the user interface are not impacted by this limit.