Issue
- We have followed this How-To article: How to add security, authentication to my REST service? (Section 5.1), but guest users are still able to access our endpoint from a browser.
- If we enable
PortalSessionAuthVerifier, users without an active session are able to access the endpoint.
Environment
- Liferay DXP 7.0
Resolution
- Due to the AuthVerifiers layer design in DXP 7.0, an extra step would be needed to prevent guest users from accessing the endpoint.
- Implement a user-permission layer inside your REST application to check if a user is signed-in by adding something like this:
PermissionChecker permissionChecker = PermissionThreadLocal.getPermissionChecker();
if (!permissionChecker.isSignedIn()) {
throw new WebApplicationException(Response.Status.FORBIDDEN);
}