A-0720

🆓

Error

Always enable Page Access Protection.

APEX_APPLICATION_PAGES All APEX versions • Check and SQL-based Test

Rule Details

Severity Level: Blocker
Quality Area: Security
Fixing times: 1 mins

Quick Fix | Local-easy
Database Support: OracleDB (v7.3.4 +)

Reason

Page Access Protection makes it impossible for users to tamper session values by modifying them in the URL thanks to embedded checksums.

Make sure it is set to argumentsMustHaveChecksum. The values noArgumentsSupported and noUrlAccess are valid as well.

Examples

Non-Compliant Example

page 1 (
    // ...
    security {
        // no pageAccessProtection
    }
)

A missing pageAccessProtection attribute gets evaluated to "unrestricted".

Compliant Solution - ★★★★★

page 1 (
    // ...
    security {
        // other good values: `noArgumentsSupported`, `noUrlAccess`
        pageAccessProtection: argumentsMustHaveChecksum
    }
)

Tests

Test SQL query

select aa.workspace || '.' || aa.alias || '.' || ap.page_id as identifier,
       'pageAccessProtection should be set to argumentsMustHaveChecksum in app ' 
       || aa.alias || ' in page ' || ap.page_id || ' of ' || aa.workspace || '.' as message
  from apex_application_pages ap
  join apex_applications aa
    on ap.application_id = aa.application_id
       and ap.workspace = aa.workspace
 where lower(page_access_protection) = 'unrestricted'
   and aa.workspace in (#ApexWorkspaces#)

Test results

Identifier	Message	Migration
WORKSPACE.CUSTOMERS.1	pageAccessProtection should be set to argumentsMustHaveChecksum in page 1 of app CUSTOMERS in WORKSPACE.	-

Parameters

Use parameters to customize the rule to your needs.

Parameter	Description	Default Value
ApexWorkspaces	Comma-separated List of APEX workspaces owning APEX applications to check.	dblinter, dbl_gui

References

related to OWASP A01:2021 – Broken Access Control
same as UC-0720