Blocking anonymous access to Crx in a non dispatcher protected instance

IssueIn an AEM instance (especially publish) users can anonymously access content explorer and crxde lite and browse the site's content. How to block anonymous access to CRX & crxde light in a non-dispatcher protected CQ instance?

ResolutionOne of the option is to create a filter following [1]. Attaching the sample source code [2]. To verify out of the box the steps are

Install the package Sample Login Redirect-1.zip (Download) in AEM instance.
Access http://localhost:4502/crx/de Or http://localhost:4502/crx/explorer. It redirects to the login page.
Notes

The sample attached is to demonstrate using a whiteboard HTTP filter to prevent access to /crx/ by checking cookies and you can implement a lot of other things like dispatcher rules kind of things, checking request authentication 

The disadvantage with this approach is for each request of a crx filter is called.

[1] http://felix.apache.org/documentation/subprojects/apache-felix-http-service.html

[2]

package com.sample.loginredirect.filter;

import javax.servlet.*;
import java.io.IOException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.RequestDispatcher;

public class LoginRedirectFilter
implements Filter
{
private final String name;
public LoginRedirectFilter(String name)
{
this.name = name;
}
public void init(FilterConfig config)
throws ServletException
{
doLog("Init with config [" + config + "]");
}
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException
{
if ( req instanceof HttpServletRequest && res instanceof HttpServletResponse ) {
final HttpServletRequest request = (HttpServletRequest)req;
final HttpServletResponse response = (HttpServletResponse)res;
String pathInfo = request.getPathInfo() ;
boolean crxdeAuthenticated = false;
boolean crxAuthenticated = false;
if(pathInfo != null){
Cookie[] cookies = request.getCookies();
if(cookies!=null){
for (int i = 0; i < cookies.length; i++) {
String name = cookies[i].getName();
String value = cookies[i].getValue();
if(name!=null && name.equals("login-workspace") && value!=null){
crxAuthenticated = true;
}
if(name!=null && name.equals("login-token") && value!=null){
crxdeAuthenticated = true;
}
}
}
if(pathInfo.startsWith("/crx/explorer/crx_main_files/admin.css")){
//Do nothing
}else if ( !pathInfo.startsWith("/crx/explorer/login.jsp") && pathInfo.startsWith("/crx/explorer") && !crxAuthenticated ){
response.sendRedirect("/crx/explorer/login.jsp");
return;
}else if( ( pathInfo.startsWith("/crxde") || pathInfo.startsWith("/crx/de") ) && !crxdeAuthenticated ){
RequestDispatcher rd = request.getRequestDispatcher("/libs/granite/core/content/login.html");
rd.forward(request, response);
return;
}
}
}
chain.doFilter(req, res);
}
public void destroy()
{
doLog("Destroyed filter");
}
private void doLog(String message)
{
System.out.println("## [" + this.name + "] " + message);
}
}

[3] Download Package by clicking here