in src/main/java/org/apache/sling/security/impl/ReferrerFilter.java [484:495]
private boolean isExcludedPath(HttpServletRequest request) {
if (this.excludedPaths == null) {
return false;
}
String path = request.getPathInfo();
for (final String excludedPath : this.excludedPaths) {
if (excludedPath != null && excludedPath.equals(path)) {
return true;
}
}
return false;
}