@Component(
   property = {
      JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE+ "=/greetings",
      JaxrsWhiteboardConstants.JAX_RS_NAME+ "=Greetings.Rest",
         "auth.verifier.guest.allowed=true",
         "oauth2.scopechecker.type=none",
         /*"liferay.access.control.disable=true",*/
         /*"auth.verifier.auth.verifier.PortalSessionAuthVerifier.urls.includes=/*"*/
   },
   service = Application.class
)
public class ItemsServiceApplication extends Application {

   public Set<object> getSingletons() {
      return Collections.<object>singleton(this);
   }

   @GET
   @Produces("text/plain")
   public String working(@Context HttpServletRequest request) throws PortalException {

      User user=PortalUtil.getUser(request);
      if(user.isDefaultUser()){
         throw new PortalException("Not logged, byeeeeeeeeeeeeee");
      }

      return user.getFullName(); //&lt;-- it works!
   }<br>The difference between my liferay version and that example is:<br>if I just use&nbsp; "auth.verifier.guest.allowed=true", "oauth2.scopechecker.type=none", still doesnt work. I get this message even if logged in:&lt;Forbidden&gt;&lt;message&gt;Access denied to com.packet.test#working&lt;/message&gt;&lt;/Forbidden&gt;<br>But If I put&nbsp;"liferay.access.control.disable=true", then I can avoid also the&nbsp;oauth2.scopechecker.type, I can call the endpoint from browser and console.<br>I find all this configuration thing really really confusing. Basically I'm still unable to use the "portalSession", If I put the&nbsp; /*"auth.verifier.auth.verifier.PortalSessionAuthVerifier.urls.includes=/*"*/ <br>At that point i dont get the message&nbsp;&lt;Forbidden&gt;&lt;message&gt; but a Redirect to localhost:8080 and I see in liferay console:<br>2019-11-19 08:54:10.792 WARN &nbsp;[http-nio-8080-exec-3][code_jsp:?] {code="403", msg="Authorization required", uri=/o/greetings/}<br>How Am I suppose to authenticate here using PortalSession ?<br>Thanks!</object></object>

@Component(
	property = {
		JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE + "=/items",
		JaxrsWhiteboardConstants.JAX_RS_NAME + "=Items.Rest",
		"auth.verifier.guest.allowed=false",

	},
	service = Application.class
)
public class itemsRESTApplication extends Application {
	public Set<object> getSingletons() {
		return Collections.<object>singleton(this);
	}

	@GET
	@Produces("application/json")
	public String working(){return "hello!";}
<br>I want to be able to call this endpoint /o/test just because I'm already logged in in liferay. So no guest allowed but I just want session ID from browser like every call you do in api/jsonws and so on. How to setup this jaxrs/liferay configuration for let this happen ? Because If I try to call with browser the above service I get in console: <br>2019-11-27 10:32:15.159 WARN&nbsp; [http-nio-8080-exec-5][code_jsp:175] {code="403", msg="Authorization required", uri=/o/items}<br>Even if I AM logged in as Administrator.<br><br>Thanks</object></object>

@Component(
        property = {
                JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE + "=/issue-admin-rest-api/project",
                JaxrsWhiteboardConstants.JAX_RS_NAME + "=Project.Configuration",
                "auth.verifier.guest.allowed=false",
                "oauth2.scopechecker.type=none"
        },
        service = Application.class
)
public class AdminRestAPIApplication extends Application {
...

[code]

    <title>Http Status 403 - http-status-code[403]</title>


<h1>Http Status 403 - http-status-code[403]</h1>
<p>
    Message: Authorization required</p>
<p>
    Resource: /o/issue-admin-rest-api/project/FPT</p>

Having said that I wonder how  "auth.verifier.guest.allowed=false", makes sense? Guest  has no password...

You can invoke the jax-rs endpoint using Liferay.Util.fetch. Using this method the x-csrf-token header is sent and the endpoint responds correctly.

If you want to call it via jquery (as I was trying to do) you have to disable cors.

<%@ include file="/init.jsp" %>
<script
        src="https://code.jquery.com/jquery-3.5.1.min.js"
        integrity="sha256-9/aliU8dGd2tb6OSsuzixeV4y/faTqgFtohetphbbj0="
        crossorigin="anonymous"></script>

<script>
    $(document).ready(function(){
        // works only if cors is disabled
        $.get('/o/greetings', function (data){
            console.log(data);
        })

        // always works, the fetch method sends the x-csrf-token header
        Liferay.Util.fetch('/o/greetings', {
            method: 'GET'
        }).then(resp => console.log(resp));
    });
</script>
<p>
    <b><liferay-ui:message key="myapp.caption"/></b>
</p>

To disable cors add `"auth.verifier.auth.verifier.PortalSessionAuthVerifier.check.csrf.token=false"` property to your component.

@Component(
    property = {
        JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE + "=/greetings",
        JaxrsWhiteboardConstants.JAX_RS_NAME + "=Greetings.Rest",
        "oauth2.scopechecker.type=none",
        "auth.verifier.auth.verifier.PortalSessionAuthVerifier.check.csrf.token=false"
    },
    service = Application.class
)
public class MyRestApiApplication extends Application {
...