Initiating asynchronous process through JSP

Question

When I take a look at the doLogin.jsp which is used to login to the bpel console, this UI is already packaged when you've installed Oracle Bpel Process Manager, an attribute is put on the session that contains the authentication to the Oracle Bpel Domain.
e.g. request.getSession().setAttribute(ServletUtils.getLocatorSessionName(domain),new Locator(auth));
When I use my own JSP that invokes an asynchronous process and redirects to the displayInstance.jsp which used to follow up the process I don't need to authenticate to the bpel domain? I've used the same code as the CreditRatingService.jsp from the 102.InvokingProcesses sample.
The question I have is that using my own UI-logic I don't need to set the attribute on the session, I can just access the displayInstance.jsp using the ReferenceId of my process without having to set the session-attribute, is this a security problem ?
When I access a url using the domain-name in the url, i can just access the page without having to authenticate.
Regards,
Nathalie

Answer 1

I've used the sample application as a reference, and I'm using the same code example in my jsp but my question is what about supplying username/password credentials when accessing the bpel console? I don't need to set any credentials on the session and still I'm able to access the bpel console?