Enabling information about server errors in the JSON response

Issue

• There is no error messages from api json services.
• How to manage the serialization and access to  Json services
• In Liferay Portal 6.2 or DXP7.0 the server response is serialized and shows information related with server errors but now their are empty.

Environment

• Liferay DXP 7.2.7.3, 7.4

Resolution

• All the information responses from the server should be managed in order to avoid security leaks.
• With Json Api the exceptions are serialized and sended as they are generated. The following property was added to disable the Json service serialization. It is encouraged to set this to false in production environments:   
  • json.service.serialize.throwable=false

  • If enabled, is able to restring their use in different ways:
    
    • Service Security layers:
      • By IP or hostname with jsonws.servlet.hosts.allowed
      • By the authenticity layer
      • By the user permissions
    • Jsonws configuration:
      • Limiting methods availables with jsonws.web.service.invalid.http.methods=
      • Limiting public access to certain methods: with jsonws.web.service.public.methods=
        
        

Additional Information

• With Headless Rest Apis these errors are handled by interpreting them and displaying the appropriate info. It follows the OpenAPI specifications
• Portal properties