Submit Feedback
Legacy Knowledge Base
Published Sep. 10, 2025

Is it possible to block direct access to a portlet render URL?

Written By

Jose L. Bango

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • We would like prevent direct access to portlet render URLs (/c/portal/render_portlet) that bypass normal navigation within the portal. 
  • These portlets have been manually added to the page.
  • Example URL: 
    /c/portal/render_portlet?p_l_id=17&p_p_id=com_acme_z3x1_portlet_MyPortlet_INSTANCE_X4QSG&p_p_lifecycle=2

Environment

  • Any Liferay DXP Version

Resolution

There is no supported way to block these URLs out of the box. Out-of-the-box portlet permissions are not granular enough to cover this use case.

Possible workarounds include:

  1. Blocking the URL pattern in the app server/web server.
  2. Adding a custom portlet filter to restrict, intercept, and block the portlet rendering if it is not loaded within a page.

However, note that these approaches are not recommended as they might cause unexpected behavior.

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?