Protect APEX URLs with Session State Protection
Command Palette
Search for a command to run...
Comments (1)
Join the discussionT
Tomas Juarez4y ago
Hi Jon, Maybe yo can help me. I need to avoid ssp on a particular page, but even when I set the Page Access Protection to 'Unrestricted' (I know this is not recommended), the checksum verification occurs. Is there something else that I should set to avoid ssp?
T
Tomas Juarez4y ago
Jon Dixon Hi Jon, thanks for your answer. I have already checked the item SSP, and it's unrestricted as well as the page SSP.
Oracle APEX Shorts
Part 31 of 35
Oracle APEX ideas and insights that you can read in four minutes or less.
Secure your Secrets with APEX Web Credentials
Oracle APEX Web Credentials Oracle APEX Web Credentials provides a convenient and secure mechanism for storing the following types of credentials: Basic Authentication (Username & password) OAuth2 Client Credentials (Client ID & Client Secret) OCI...
More from this blog
Inside an APEX 26.1 AI Interactive Report Request
Introduction One of the marquee features of APEX 26.1 was AI Interactive Reports. When I started testing this new feature, I was interested to see what was going on behind the scenes. In this post, I
Jul 30, 202666 min read
Using an APEX AI Agent to Turn Purchase Orders into JSON
Introduction One of the marquee features of APEX 26.1 is APEX AI Agents. APEX AI Agents allow you to use an LLM and your own PL/SQL and JS tools to perform actions on your data instead of just chattin
Jul 16, 20269 min read
APEX AI Agent Handlers: Intercepting & Updating Requests and Responses
Introduction In my previous post, I looked at logging APEX AI Agent requests and responses with Request and Response handlers. Logging is the first step because it shows you what is actually moving th
Jul 2, 202610 min read
APEX AI Agent Logging with Request & Response Handlers
Introduction Logging is one of the first things you need when building serious AI Agents. Without it, debugging quickly becomes guesswork. You can see the final answer, but not always why the model ch
Jun 25, 202611 min read
AI Agents Need Boundaries, Not Bigger Prompts
Context management patterns from building agents in Oracle APEX
Jun 4, 202612 min read
If you disable SSP at the Application Level, all other page, page item, and application item SSP settings will be ignored.
Enabling Page Access Protection prevents users from tampering with the URL while on that page. It does not prevent users on other pages from tampering with items on a page with Page Access Protection enabled. For example, if you enable Page Access Protection for page 15 but have it disabled for page 14, then a user on page 14 could still tamper with items on page 15 but not the other way around. You only must forget to set this on one page, and it opens up every item on every other page to attack.
Page Item SSP may be the most important. You are protected if SSP is set for your application, and you have SSP enabled for every single page item. This is regardless of whether Page Access Protection is enabled.