Liferay JSON Web Services available at /api/jsonws is open access for any u

RE: Liferay JSON Web Services available at /api/jsonws is open access for a

2020-03-10T11:39:21Z

Great help. So I decided not to use Permissions for this purpose. I used jsonws.servlet.hosts.allowed in portal-ext.properties and restricted the access to that page to some safe IPs.

RE: Liferay JSON Web Services available at /api/jsonws is open access for a

2020-03-08T11:50:23Z

Well, the page itself is the least of your problems. You really should upgrade to a newer Liferay version.
That said, David Nebinger wrote a blog about securing that page, but it applies only to 7.0+
https://liferay.dev/blogs/-/blogs/securing-the-api-jsonws-ui
You should be able to do the same (codewise) for 6.2 by using a hook.

Liferay JSON Web Services available at /api/jsonws is open access for any u

2020-03-08T10:44:27Z

I asked this question on StackOverflow but I didn't receive any answer. So I am repeating it here. I hope someone can help me.

On Liferay 6.2, the JSON Web Services are open access via http://example.com/api/jsonws. I know that I can restrict access to it to some special IPs via portal-ext.properties. But I want to grant this permission just to Administrators to see this page. A Liferay document says

"Liferay’s user permission layer is the last Liferay security layer triggered when services are invoked remotely."

But I couldn't find anything nor in portal.properties neither in Control Panel/Roles to set such permission for Administrators to prevent others from seeing http://example.com/api/jsonws.
..