12.3. Securing Ajax requests

Security is an important aspect of applications, including portals, that use Ajax. A portal server provides a security framework for the web portal, and it’s responsible for authenticating and authorizing portlet requests.

Servlets fall outside the portal security framework provided by the portal server, and it’s up to the portal server to provide proprietary ways of securing servlets or to leave it to the portlet developer to implement a custom security framework for securing servlets. If the portlet developer is responsible for implementing servlet security, then the developer is responsible for creating portlets that can share authentication and authorization data with servlets using portlet sessions.