[SLING-8866] Add reporting info in the XSS Protection API bundle

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: XSS Protection API 2.2.0
• Component/s: XSS Protection API
• Assignee: Radu Cotescu
• Reporter: Radu Cotescu
• Created: 29/Nov/19 11:19
• Updated: 27/Jan/20 13:16
• Resolved: 16/Jan/20 16:51

Description

The XSS Protection API should be enhanced to provide some reporting about invalid URLs in order to allow operators of a Sling instance to monitor the state of the system (e.g. incorrect AntiSamy configurations, attacks, DOS attempts, etc.).

The following ideas should be taken into consideration:

1. add last X blocked expressions to the Sling XSS Web Console page
2. generate blocked metrics, based on configurable paths, e.g. /libs, /apps, /content.

Issue Links

• links to: GitHub Pull Request #8