Liferay 7.3中使用JAX-RS构建REST API时遇403和405错误求助

Let's tackle your JAX-RS endpoint issues step by step—both the 403 on GET requests and 405 on POST requests have clear fixes once we break down the root causes.

1. Why You're Getting 403 Forbidden (GET Requests) #

Liferay 7.3 applies security checks to JAX-RS endpoints by default, even if you have an OAuth2 token. Here's what's likely happening:

• Your OAuth2 token might not have the correct scope to access the /greetings endpoints.
• Liferay's default auth verifiers are blocking unauthenticated or improperly scoped requests.

Fix for 403: #

For testing purposes, you can temporarily allow guest access to your endpoints (don't do this in production without proper security controls):

• Add the auth.verifier.guest.allowed=true property to your @Component annotation.
• Alternatively, add the @PermitAll annotation to your application class to allow all requests to access your endpoints.

Updated component configuration example:

@Component(
    property = {
        JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE + "=/greetings",
        JaxrsWhiteboardConstants.JAX_RS_NAME + "=Greetings.Rest",
        "auth.verifier.guest.allowed=true" // Enable guest access for testing
    },
    service = Application.class
)
@PermitAll // Allow all methods to be accessed without additional auth checks
public class LiferaxJaxRsTestApplication extends Application {
    // ... rest of your code
}

For production, ensure your OAuth2 client has the correct scopes configured in Liferay (match the /greetings/* resource path) and use role-based annotations like @RolesAllowed instead of @PermitAll.

2. Why You're Getting 405 Method Not Allowed (POST Requests) #

This error usually means JAX-RS can't find a matching method to handle your POST request. The main issue here is JSON deserialization failure:

• Your User class doesn't have a no-argument constructor, which is required by Jackson (Liferay's default JSON provider) to create an instance from the request body.

Fix for 405: #

Add a no-argument constructor to your User class, and ensure your POST request sends a valid JSON body with the correct Content-Type: application/json header.

Updated User class:

class User {
    private String firstName;

    // Required for JSON deserialization
    public User() {}

    public User(String firstName) {
        this.firstName = firstName;
    }

    public String getFirstName() {
        return firstName;
    }

    public void setFirstName(String firstName) {
        this.firstName = firstName;
    }
}

Additionally, your POST method is marked as @Produces(MediaType.APPLICATION_JSON) but returns a plain string. To return valid JSON (and avoid client parsing errors), modify the method to return a structured JSON response:

@POST
@Path("/morning")
@Produces(MediaType.APPLICATION_JSON)
@Consumes(MediaType.APPLICATION_JSON)
public Response hello(User user) {
    String greeting = "Good morning! " + user.getFirstName();
    return Response.ok(Map.of("greeting", greeting)).build();
}

Final Checks #

• For OAuth2: Verify your token includes the scope for /greetings/* (check Liferay's OAuth2 client configuration).
• For POST requests: Ensure your request body looks like {"firstName": "YourName"} and the Content-Type header is set to application/json.

After making these changes, redeploy your module and test the endpoints again—both GET and POST should work as expected.

内容的提问来源于stack exchange，提问作者skdonthi