Controlling Role Visibility via Headless API

Issue

• The /o/headless-admin-user/v1.0/roles API exposes all system roles, potentially revealing sensitive information about permission structures, user roles, and their associated components (portlets).

Environment

• Liferay DXP 7.4
• Liferay DXP Quarterly Releases

Resolution

• You can control the role visibility through the API by managing each role's permissions. By default:
  • Owner: All permissions.
  • User (authenticated users): View permission.
  • Guest (anonymous users): No view permission.
• To restrict a specific role's visibility (e.g., Administrator):
  1. Go to the role (e.g., Administrator).
  2. In the options menu (⋮), select Permissions.
  3. Remove the View permission from the User role. 
• This prevents non-administrative users from seeing the "Administrator" role via the API.
• Nevertheless, if an attacker knows a system uses Liferay, they don't need to access its API to find default permissions and portlets. This is because Liferay is open-source, allowing access to its code, and the software can be downloaded and installed locally to inspect its default settings.

Additional Information

• Creating and Managing Roles