A-0700

🆓

Error

Always enable Session State Protection at the application level.

All APEX versions APEX_APPLICATIONS • Check and SQL-based Test

Rule Details

Severity Level: Blocker
Quality Area: Security
Fixing times: 1 mins

Quick Fix | Local-easy
Database Support: OracleDB (v7.3.4 +)

Reason

Session State Protection prevents URL tampering, a malicious user modifying URL parameters or their checksums to reach data they are not entitled to. Enabling it at the application level makes APEX reject tampered links across the whole application.

Enable it under Shared Components → Security Attributes → Session State Protection.

Example

Non-Compliant Example

app CUSTOMERS (
    name: Customers
    // ...
    sessionStateProtection {
        enabled: false
        checksumSalt: 9D0...
    }
    // ...
)

Compliant Solution - ★★★★★

app CUSTOMERS (
    name: Customers
    // ...
    sessionStateProtection {
        checksumSalt: 9D0...
    }
    // ...
)

Tests

Test SQL query

select workspace || '.' || alias as identifier,
       'App ' || alias || ' in ' || workspace || ' does not have Session State Protection enabled.' as message
  from apex_applications
 where session_state_protection = 'Disabled'
   and workspace in (#ApexWorkspaces#)

Test results

Identifier	Message	Migration
WORKSPACE.CUSTOMERS	App CUSTOMERS in WORKSPACE does not have Session State Protection enabled.	-

Parameters

Use parameters to customize the rule to your needs.

Parameter	Description	Default Value
ApexWorkspaces	Comma-separated List of APEX workspaces owning APEX applications to check.	dblinter, dbl_gui

References

related to OWASP A05:2021 – Security Misconfiguration
same as UC-0700