Headless APIs returning 500 error code for unauthorized access

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.4.3.8 CE GA8, 7.4.13 DXP U4, Master
• Component/s: REST infrastructure (vulcan)
• Labels:
  • fi-s-headless
  • liferay-update-dxp-5-7413
  • pt-app-security-review
• Story Points: 3
• Fix Priority: 3
• Sprint: S04E30 - Sea Change
• Git Pull Request: https://github.com/liferay-appsec/liferay-portal/pull/546

When performing a request to a Headless API without authentication (or with the wrong credentials) instead of answering with a 403/404 error, the system is answering with a 500 error code.

 

Steps to reproduce:

1.- perform a GET request to http://localhost:8080/o/headless-delivery/v1.0/sites/Guest/structured-contents

The same happens for other endpoints.

 

Current result:

1.- 500 error is returned.

 

Expected:

• Check previous behavior, not sure if we were returning an empty list, 404, or 403