A-0720 Always enable Page Access Protection.

Severity Error Check + SQL-based Test Free

APEX_APPLICATION_PAGES

Rule Details

SonarQube Severity: Blocker
Quality Area: Security
Fixing Time: 1 min Local-easy Quick Fix
Database Support: OracleDB (v12.2.0 +)
Profile: Essential
Available Since: Jul 27, 2026

Reason

Page Access Protection makes it impossible for users to tamper session values by modifying them in the URL thanks to embedded checksums.

Make sure it is set to argumentsMustHaveChecksum. The values noArgumentsSupported and noUrlAccess are valid as well.

Example

Non-Compliant Example

page 1 (
    // ...
    security {
        pageAccessProtection: unrestricted
    }
)

Compliant Solution - ★★★★★

page 1 (
    // ...
    security {
        // other good values: `noArgumentsSupported`, `noUrlAccess`
        pageAccessProtection: argumentsMustHaveChecksum
    }
)

Tests

Test SQL query

select aa.workspace || '.' || aa.alias || '.' || ap.page_id as identifier,
       'pageAccessProtection should be set to argumentsMustHaveChecksum in app ' 
       || aa.alias || ' in page ' || ap.page_id || ' of ' || aa.workspace || '.' as message
  from apex_application_pages ap
  join apex_applications aa
    on ap.application_id = aa.application_id
       and ap.workspace = aa.workspace
 where lower(page_access_protection) = 'unrestricted'
   and aa.workspace in (#ApexWorkspaces#)
   and (json_value(json_array(#ApexAppIds#), '$[0]') is null
        or json_exists(json_array(#ApexAppIds#), '$[*]?(@ == $id)' passing to_char(aa.application_id) as "id"))

Test results

Identifier	Message	Migration
WORKSPACE.CUSTOMERS.1	pageAccessProtection should be set to argumentsMustHaveChecksum in page 1 of app CUSTOMERS in WORKSPACE.	-

Parameters

Use parameters to customize the rule to your needs.

Parameter	Description	Default Value
ApexAppIds	Comma-separated list of APEX application IDs to check. If empty, all applications of the workspaces are checked.	,
ApexWorkspaces	Comma-separated List of APEX workspaces owning APEX applications to check.	dblinter, dbl_gui

References

related to OWASP A01:2021 – Broken Access Control
same as UC-0720