UI-related exceptions such as BadRequestException, ResourceNotFoundException, HttpNotFoundException, ForbiddenActionException, PermissionDeniedException, HttpForbiddenException, DeserializeBodyException, and DeserializeValueException no longer redirect users to dedicated error URLs. Instead, the platform renders the corresponding 400, 403, 404, and 500 error templates directly, preserving error information and providing a more reliable user experience. API requests continue to return ResponseEntity with the appropriate HTTP status code and response body.

The Web SDK now includes WebAbstractGlobalExceptionHandler, which standardizes the generation of 400 Bad Request, 403 Permission Denied, 404 Not Found, and 500 Internal Server Error views. Themes and custom implementations can override the default error templates through methods such as getBadRequestViewTemplate(), getPermissionDeniedViewTemplate(), getNotFoundViewTemplate(), and getServerErrorViewTemplate().

Added AdminViewFactory.newErrorViewBuilder() to create Admin error pages using the same builder pattern as other views. Error pages now automatically include the currentPageTitle variable, while AdminViewDecorator provides default values for currentParentTitle and currentParentURL, ensuring consistent navigation and page rendering.

AdminGlobalErrorHandler and WebGlobalErrorHandler now distinguish between page requests and API requests more effectively. For page requests, the platform renders the appropriate error page directly instead of redirecting. For API requests or non-GET requests, JSON error responses continue to be returned. In debug mode, exceptions are still returned as responses to simplify troubleshooting during development.

Introduced the check_user_required_authentication_api event, allowing WebAuthenticationInterceptor to ask registered event handlers whether an API requires user authentication, even when the URI has not been explicitly marked as authenticated in RequestURIManager. A corresponding WebCheckUserRequiredAuthenticationApiEventSchemaFetcher has also been added to describe the event schema, including requestArguments, uriTemplate, method, and the Boolean result.

The HTTP SDK now provides HttpResponses.clearCookie() and HttpResponses.newClearedCookie() to standardize cookie removal. These utilities are reused for Admin access tokens, User access tokens, and Market SSO cookies while supporting configurable path and httpOnly attributes, reducing duplicated code and improving consistency.

AdminMarketProxyController now uses HttpResponses.newClearedCookie() to remove the nonce and callbackUri cookies after a successful callback. This change aligns Market SSO cookie handling with the rest of the platform and simplifies future maintenance.