Remove web access for extensions in hybris

[Former Member]

Few extensions created are unexpectedly behaving as web extensions.This is a possible security issue . We are only expecting ..storefront extension to be a web extension. Could you please give suggestions.

[Marko_salonen]

Just to clarify that you should not disable the ones that behave as web extensions because these ussually need to be ones. For example cockpits, backoffice and so on. What you should do instead is: Disable those extensions that are not needed for customers in localextensions.xm for each customer frontend node. Restrict access for all none frontend web extensions in the loadbalancer.

You can find all web roots in hac.