JSR-168 allows session attributes sharing between servlets and portlets of a same context (PLT.15.4). This is the recommended way to download files from a portlet and for AJAX communication (see http://developers.sun.com/prodtech/portalserver/reference/techart/ajax-portlets.html).

To make session sharing possible, emptySessionPath="true" must be present in server.xml and portlet session attributes must be set with PortletSession.APPLICATION_SCOPE. This work fine with uPortal 2.5.

Sharing attributes with a servlets in a portlet context cause a security issue in uPortal. Since created portlets contexts are not invalidated on uPortal logout, portlets session still active and servlets presents in theses contexts still available after the logout.

The same issue where recently fixed on Jetspeed 2 (http://issues.apache.org/jira/browse/JS2-582).

The solution is to invalidate all created portlets sessions on the end-of-session cleanup.