Liferay JSON Web 服务位于 /api/jsonws 对任何用户开放访问

Question

On Liferay 6.2, the JSON Web Services are open access via http://example.com/api/jsonws . I know that I can restrict access to it to some special IPs via portal-ext.properties . But I want to grant this permission just to Administrators to see this page. A Liferay document says

Liferay's user permission layer is the last Liferay security layer triggered when services are invoked remotely.

But I couldn't find anything nor in portal.properties neither in Control Panel/Roles to set such permission for Administrators to prevent others from seeing http://example.com/api/jsonws .

Answer 1

As @Olaf Kock commented under my question, after not getting answered here, I repeated my question in Liferay forum . I repeat the digest of that thread here:

In Liferay 6.2, that page cannot be restricted using Permissions unless I write a hook. For Liferay 7.0+, this post is helpful. Eventually, I used jsonws.servlet.hosts.allowed in portal-ext.properties and restricted the access to that page to some safe IPs.