title: Securing liferay portlets with spring security
body: <p>I am currently working with a liferay portlets. Spring security is used on the Rendering layer( in jsp pages). However, it is not safe, because my dispatch controllers and services do not have any security/authorization checks.</p>
  
  <p>In my application, Spring-MVC controller receives the request, and passes to the Service Layer. Service Layer builds the result and passes it to the JSP pages. In jsp pages we have the security authorization using spring-security taglibs. </p>
  
  <p>I want to know the following:</p>
  
  <ol>
  <li>Best practises regarding implementing authorization for portlets.</li>
  <li>Which is better choice to implement security either on Dispatch layer or Service layer?</li>
  <li>How to implement security for dispatch layer or service layer?</li>
  </ol>
  
  <p>Please consider that I have security in my application on use-case bases. </p>
  
  <p>Thank you!</p>