A-0700 Always enable Session State Protection at the application level.

Severity Error Check + SQL-based Test Free

APEX_APPLICATIONS

Rule Details

SonarQube Severity: Blocker
Quality Area: Security
Fixing Time: 1 min Local-easy Quick Fix
Database Support: OracleDB (v12.2.0 +)
Profile: Essential
Available Since: Jul 27, 2026

Reason

Session State Protection prevents URL tampering, a malicious user modifying URL parameters or their checksums to reach data they are not entitled to. Enabling it at the application level makes APEX reject tampered links across the whole application.

Enable it under Shared Components → Security Attributes → Session State Protection.

Example

Non-Compliant Example

app CUSTOMERS (
    name: Customers
    // ...
    sessionStateProtection {
        enabled: false
        checksumSalt: 9D0...
    }
    // ...
)

Compliant Solution - ★★★★★

app CUSTOMERS (
    name: Customers
    // ...
    sessionStateProtection {
        checksumSalt: 9D0...
    }
    // ...
)

Tests

Test SQL query

select workspace || '.' || alias as identifier,
       'App ' || alias || ' in ' || workspace || ' does not have Session State Protection enabled.' as message
  from apex_applications
 where session_state_protection = 'Disabled'
   and workspace in (#ApexWorkspaces#)
   and (json_value(json_array(#ApexAppIds#), '$[0]') is null
        or json_exists(json_array(#ApexAppIds#), '$[*]?(@ == $id)' passing to_char(application_id) as "id"))

Test results

Identifier	Message	Migration
WORKSPACE.CUSTOMERS	App CUSTOMERS in WORKSPACE does not have Session State Protection enabled.	-

Parameters

Use parameters to customize the rule to your needs.

Parameter	Description	Default Value
ApexAppIds	Comma-separated list of APEX application IDs to check. If empty, all applications of the workspaces are checked.	,
ApexWorkspaces	Comma-separated List of APEX workspaces owning APEX applications to check.	dblinter, dbl_gui

References

related to OWASP A05:2021 – Security Misconfiguration
same as UC-0700