APEX 4.1 Login page kills the existing session cookie

So far the session cookie enabled us to figure out if the user has already had a session and redirect them to the page they wanted using this session (thanks to a method on the page of connection). Just try APEX 4.1 and it seems that this quick hack will not work, because:
a. the session cookie has been replaced by the time that the login page is loading
b. the login page gives no clue as to the destination of the user actually wanted (used to be able to verify OWA_UTIL. GET_CGI_ENV('QUERY_STRING') to see what looked like the URL, but now the URL is simply the login page)

The problem that I am trying to solve is a job of logging system where users get a lot of e-mail notifications. With the standard behavior of the APEX, they will have to identify each time they click on a link in an e-mail. Because it is a rather unusual behavior for another web application, I used, anyone has any ideas about how to get the APEX to stop killing sessions by substituting the cookie whenever it sees a URL he dislikes? Have tried to use the session 0, but still it beats my cookie.

Hey Capt egg,

Nice to see that you studied and found a solution. However, I think that things can be a bit improved. It seems that you already used a custom authentication scheme, it is good, because it allowed to use application session hooks join. However, I think that this does not exactly what you expect.

During the installation of the session, at the beginning of the Summit "request for treatment, he runs about this code:"

1 write the session id of the query (parameter to URL or POST) in a global variable
2 load of metadata application authentication (cookie name, Sentry function, function of invalid session, etc.)

3. If a global session exists, run "Builtin Cookie Sentry":
3.1 query the table of the session by the value of the cookie.
3.2 If the session of the query id matches the overall session id, session information matching.
3.3. in the case, the session information is incomplete, reset the session variable.

4. If this is not the login page, run application-specific Sentinel:
4.1 run the result of the Sentinel session function if a function is defined
4.2 If the Sentinel returned true function, run the validation function if it is set

5. "create / reuse Session."
5.1. If the session variable points to a valid session record, the user to read and other variables of the session save
5.2 in the case, create a new session not authenticated

6. write a new cookie in HTTP session if a new session was created

7. If the sentinels (4) returned false, run 'Invalid Session Manipulation':
7.1 save deep link in the current page
7.2 run invalid session function if a function is defined
7.3 redirect to url "Invalid Session" of authentication

This is only an overview and implementation details may change. However, I think that it can show major problems with the help of the function of invalid session for Assembly of the session:

-In (4.1), the engine creates a record of the session and the session id
-In (6), the engine creates a session cookie
-Invalid session feature modifies the session global variable id back to the old session, but there is still a newly created session
-The function of session invalid re-inits the htp buffer and thus cancels (6) high. The connection of the session would create a new session for each request, otherwise.

My suggestion is that you use a sentinel of session instead. Here is an example:

function session_joining_sentry return boolean is
  l_cookie_session_id number;
  l_user              APEX_WORKSPACE_SESSIONS.USER_NAME%TYPE;
  l_result            boolean;
  procedure dbg(p_str in varchar2)
  is
  begin
    apex_application.debug('session_joining_sentry: '||p_str);
  end dbg;
begin
  if APEX_CUSTOM_AUTH.GET_SESSION_ID is not null then
    dbg('apex could already determine session by URL session id and cookie value');
    l_result := true;
  else
    dbg('apex could not determine session by URL session id and cookie value');
    l_cookie_session_id := APEX_CUSTOM_AUTH.GET_SESSION_ID_FROM_COOKIE;

    if l_cookie_session_id is not null then
      dbg('apex found session via cookie. we try to re-use this as our current session id');
      begin
        select user_name
          into l_user
          from APEX_WORKSPACE_SESSIONS
         where apex_session_id = l_cookie_session_id;
        l_result := true;
      exception when NO_DATA_FOUND then
        dbg('session could not be found in session table - sentry fails');
        l_result := false;
      end;

      if l_result then
        dbg('re-using session for user '||l_user);
        APEX_CUSTOM_AUTH.DEFINE_USER_SESSION (
          p_user       => l_user,
          p_session_id => l_cookie_session_id);
      end if;
    else
      dbg('apex could not find the session cookie. sentry fails');
      l_result := false;
    end if;
  end if;

  return l_result;
end session_joining_sentry;

Also, it should be noted that the session join is precarious. If you plan to implement this, please make sure that you understand the dangers of the cross-site request forgery:

http://en.Wikipedia.org/wiki/cross-site_request_forgery

Kind regards
Christian

Published by: Christian Neumueller on March 2, 2012 04:24

Tags: Database

Similar Questions

How to prevent the login page in the same browser when the user is already authenticated

Hello
I use Jdev 11.1.1.6 with ADF implemented in my application security.
I have Login.jspx that redirects the user to Home.jspx on a successful authentication. The user can either enter the URL of the Home Page or Login.
Please consider the following scenarios:
(a) the user is not authenticated in the current browser session
(a.1) if the user enters the URL of the home page and the login page is displayed and redirected to the homepage on authentication
(a.2) if the user enters the login page URL, then the login page is displayed and redirected to the homepage on authentication
(b) the user is already authenticated in the current browser session, a new tab opens and
(b.1) if the user enters the URL of the homepage then it shows directly the (already authenticated) Homepage
(b.2) if the user enters Login URL then connect a page appears - This is the issue, it should either user to the homepage or invalidate the existing session and let users to proceed again.
How do I get there? Any help is appreciated.
Thank you
JAI

Hello

the authentication check must be in a phase listener or servlet filter. If you use a phase listener and the homepage and login have a link associated with the ADF (PageDef file) then in the phase AFTER RESTORE_VIEW, you can use AdfContext.getCurrent () .getSecurityContext () .isAuthenticated () to tell if a user is authenticated or not.

Frank

Apex, language of login page set after the connection based on the user pref browser lang and application-based

Hello
Request Express 4.2.3.00.08
I created an application of multi languaguage in which the language is defined by setting: FSP_LANGUAGE_PREFERENCE
But the login page, I would like to than the login page to be displayed in the browsers language.
The url of the application connection looks like as shown below but the & BROWSER_LANGUAGE. product always (English).
f? p = & APP_ID.:LOGIN_DESKTOP: & SESSION. : FSP_LANGUAGE_PREFERENCE: & BROWSER_LANGUAGE.

LOGIN_DESKTOP is an intermediate page that has one before branch header for the page of real connection if the FSP_LANGUAGE_PREFERENCE is set prior to the loading of the page.
If I set the language set in this URL, it works as expected:
f? p = & APP_ID.:LOGIN_DESKTOP: & SESSION. : FSP_LANGUAGE_PREFERENCE:nl - page Login Show in NL
f? p = & APP_ID.:LOGIN_DESKTOP: & SESSION. : FSP_LANGUAGE_PREFERENCE:-see the login page in EN
When I put the application to choose the language based on the browser language that it works, but then I am not able to have users to save their preferences for the next time they are connected.
Any ideas on why & BROWSER_LANGUAGE. translates by "in" even though the language in the browser is different?
See you soon
Bottom

OK, he stares at me

For all those interested, this is how.

Create a page additional empy (with alias page LOGIN_FORWARD_PAGE) and set the url to connect to the application of this new page and set the value of the application on BRANCH_TO_PAGE_ACCEPT:

f? p = & APP_ID.: LOGIN_FORWARD_PAGE: & SESSION. : BRANCH_TO_PAGE_ACCEPT:

On the page to create a pl/sql process submit before calculations similar to one below which affect the en language, if the browser is not NL (in Dutch):

If upper (substr (owa_util.get_cgi_env ('HTTP_ACCEPT_LANGUAGE'), 1, 2)) = "NL" then

: FSP_LANGUAGE_PREFERENCE: = "nl";

on the other

: FSP_LANGUAGE_PREFERENCE: = 'en ';

end if;

And create a branch to submit before the treatment which redirects to the current login page (the value of FSP_LANGUAGE_PREFERENCE is then already set and the application is configured to use this setting).

After that loging in you can extract the FSP_LANGUAGE_PREFERENCE based on the user.

BTW, I had to switch to 4.2.5 there in 4.2.3 is a bug preventing to set session state when you use BRANCH_TO_PAGE_ACCEPT!

from the login page in the apex 4.1.1

Hello

My requirement is to bypass the connection when run us the application and connect at the click of a tab.

I have legs like

Home, tab1, tab2, tab 3/Admin

When we run the application it should not ask passoword and recursive and should navigate directly to the House.
but, when I click on the Admin tab it should ask to connection and this must be validated from a database table. He should not claim again through the session.

some can help on this please.

Thank you
Vikas Kodari

Hi Vikas,

Use the default login page that comes at the time of the creation of application

or try the below function

create or replace FUNCTION  CUSTOM_AUTHENTICATE (p_username in VARCHAR2, p_password in VARCHAR2)
return BOOLEAN
is
  l_password varchar2(4000);
  l_stored_password varchar2(4000);
  l_count number;

 begin
 select count(*) into l_count from yourtablename where trim(upper(username)) = trim(upper(p_username));

 if (l_count > 0 ) then
   select password into l_stored_password from yourtablename where trim(upper(username)) = trim(upper(p_username));

   l_password :=  p_password;

     if upper(l_password) = upper(l_stored_password) then
            return true;
        else
           return false;
        end if;
  else
       return false;
 end if;   

end;

Kind regards
Jitendra

Login page with the notification according to the username (like the login page of LinkedIn)

Hello!
I would like to implement the feature (as is on the login page of LinkedIn) where according to saved cookie (username) there are certain notifications (messages, etc.).
How to make a such hing Apex 4.2? At least some advice what should be the right direction.
BRG
Damir

See the Notification icon with the number of pending notifications

How can I redirect to the login page when the client disconnects?

I use {module_logout}, how do I redirect to the login page when a client disconnects?

Thank you for posting.

You can redirect the user to the login page using a small java script code. Please visit the following link http://kb.worldsecuresystems.com/598/bc_598.html#main_Redirecting_to_another_page

See you soon,.

Scott Raj Rouanet

Adding a login page from the client to the Web of Adobe Muse site

Hi all
I have a client who wants to be able to add a feature to their website where we have a page on the site where their customers can log in to access the files. The files may not be accessible to the public, so basically, we want to create a page on the Web site where the page is protected password/user.
Is this possible? and if so, how?
Sarah | Ink of the image

No, he can't. Well well, not in the strict sense. If you simply want to protect a folder that contains the fields, you can use .htaccess files, but it is a server thing you need to check with your hosting provider. It has nothing to do with the Muse or the design of the actual page. All of this requires a system dynamic like Joomla, Drupal or other.

Mylenium

How to create a new page with the existing provision of the one that I already created?

Well, I'm very new to DreamWeaver, just an info. I was ordered to develop a site for a company. There will be as a total of 10 pages on the site. I created the home page, and I'm now trying to make the other. But I don't know how I can take the basic layout, I created in the homepage so I can add information for other pages later. I tried to save as a template, but I had to create editable regions and those got in the way. I even tried to copy the code from the original, but then the Spry menus will not work correctly. I hope I passed my problem properly. Any help will be more useful.
Thank you.
1. Open index.html
2. File > save as > page2.html
3. Repeat for other pages of the site...
4. Change content as needed.
Nancy O.

ALT-Web Design & Publishing

Web | Graphics | Print | Media specialists

http://ALT-Web.com/

http://Twitter.com/ALTWEB

http://ALT-Web.blogspot.com/

Mozilla restores the pages of the last session, but I do not set and don't want

When I open Mozilla firefox, it always restores the last session pages. I tried to restore default startpage, but he restores the other pages anyway.

You can check if you have a user.js file in the Firefox profile folder that affects the pref browser.sessionstore.resume_session_once true value.
```
   http://kb.mozillazine.org/browser.sessionstore.resume_session_once
```
You can use this button to go to the Firefox profile folder:
```
   Help > Troubleshooting Information > Profile Directory: Show Folder (Linux: Open Directory; Mac: Show in Finder)
```
```
   http://kb.mozillazine.org/Profile_folder_-_Firefox
```
```
    hope it will sort out your problem
```

the call firefox.exe - ProfileManager does NOT open the Profile Manager does NOT create a new profile, KILLS the old session tabs, but all pinned!

FF 7.0.1 on Win7 pro 64

A behavior more bug / odd:
calling "firefox.exe - ProfileManager".
-do NOT open the Profile Manager,
-does NOT create a new profile,
-seems to do NOTHING (no change around records profile etc.).
but...
-KILLS tabs former session.
-KILLS old session and leaves nothing to restore,
-KILL all my pinned tabs!

OK, I should downgrade to FF4.0.1, or same 3.6.x?
These releases are much more reliable than 6 + 7 running!

Try using this:

Firefox.exe Pei

Killed the remaining sessions in the session $ v
Hello

There are 42 sessions that are KILLED but still present in the view v$ session. v$ Resource_limit must keep 300 sessions. My question is: are these sessions killed count for example if session $ v shows 250 lines and 50 are marked Killed. 200 sessions will be counted or 250?

Secondly, how can I KILL all open or multiple sessions or find them at the level of the Unix operating system which process id to kill at the level of the OS also?
```
select sid,serial#,osuser from v$session where status='KILLED';

       SID    SERIAL# OSUSER                                                       
---------- ---------- ---------------
     56      8542 SYSTEM     
- - 
42 rows selected
```
Thank you very much in advance.

Concerning
Is it possible that I have kill all sessions that are marked as being KILLED to CHANGE the SYSTEM COMMAND?

No such statement available, you have to kill one by one with alter system kill session command but you can generate all the cmd like
```
select 'alter system kill session ' || '''' || sid || ',' || serial# || '''' || ' immediate;' from v$session
where status='KILLED';
```
There is a PROCEDURE that is created for the normal user to kill user sessions

put Word IMMEDIATE in alter system kill command inside the procedure.

Error in the generator of the ApEx 4 on Edit Page of the article: ORA-06502
Hello

We took 4 ApEx (patch 4.0.1.00.03), and have a problem in a single application, where appears the error ORA-06502 character string buffer too small.) This error at bottom of the page this article Page. In addition, point editing the page "settings" section is left blank, so I can't change any settings. It also gives me wrong when creating new items, so I have to copy existing elements and change them from place. This worked until recently, when the mistake is now also displayed in the application itself, and not only in the constructor. This is a page with a tabular presentation and some elements of search filter. After having fill the filter and click on a search button, the error message and tables is not rendered. This happens from time to time, and the 'solution' is to disconnect and return to the application. I'm not 100% sure, but I guess that's the same problem as the error appearing in the report generator. It is certainly not caused by user data.

So far, I found this:

While developing the application, we regularly put the generator of the ApEx between French and English. I read that it was a cause of ORA-06502, but that this problem has been resolved in version 4.0.1.00.03. Our problem may still be linked to the multilingual constructor?

I ask this because we are running other applications in the same environment, ApEx, and they are all very good. So somehow this error in Report Designer is related to this particular application.

Any ideas?

Thanks in advance!
Hello

(1) no longer this error occurs if you export your application and install it on apex.oracle.com which has 4.0.2?
(2) do you use point type plug-ins in your application. In 4.0.1 there was a mistake in the generator if too many when installed in this application. Reduce the number of plug-ins type point or better to install 4.0.2.00.07

Concerning
Patrick
-----------
My Blog: http://www.inside-oracle-apex.com
APEX 4.0 Plug-Ins: http://apex.oracle.com/plugins
Twitter: http://www.twitter.com/patrickwolf

Firefox does not open a new, secure login page, on the site of my Bank

Site Web of my Bank opens a new, secure, log in page from a link on its home page. When I click on this link to do, nothing happens. No window opens and Firefox does not all messages as to why. He used to work, but stopped in the past two months. I don't know if it something in my settings or not. I also use the Flock browser - which is based on Mozilla code and the link works in this browser. Settings in both browsers seem to be the same.

URL of affected sites

http://banksa.com.au

I get the login window in Firefox.

It uses javascript to open the window. Try hitting control + F5 - that recharges all of the scripts in case one is corrupt in the cache.

You have additional modules that may be blocking scripts? Adblock Plus, no Script...
If so try to disable them.

Try safe mode
The problems of Firefox in Mode safe

See also
Troubleshoot and diagnose problems in Firefox

Passing the username to the login page to the home page
Dear experts,

I'm working on JDeveloper 11.1.2.2.0

I have two pages 'Login.jspx' and 'welcome.jsf '.
What I have to do is, I need to pass 'user_id' from loin successful by 'Login.jspx' to 'welcome.jsf '.
Then "welcome.jsf" will search the relevant data for this 'user_id '.

I've already created a page "welcome.jsf" and query looks like in ' Select value1, vale2,... FROM table_name where UserId =: user_id;

How can I pass this value 'user_id '?

Thank you.
Use #{securityContext.userName} if you are already connected to get the user name in the ADF

Region report on apex 4.1 upgrade page get the error ORA-01790
Hi all
We have recently upgraded from 3.1.2 to 4.1. One of the pages in several regions, one being a region of report. It has a simple sql statement:
Select
"RU_TD_ID,"
"RU_TH_ID,"
"LOC"
"DEPT"
'ACCOUNT ',.
"SUB."
"SPRT."
"DETAIL_DESC,"
"SERVICE_PERIOD,"
"DETAIL_AMT,"
"FULL_ACCT_STRING,"
'DATE_ADD ',.
"USER_ADD."
"DATE_UPD,"
'USER_UPD '.
of ' #OWNER # '. " RU_TRANS_DTL ".
where "RU_TH_ID" =: P26_RU_TH_ID

: p26_ru_th_id is entered in a header after process... I can see this field filled in other parts of the page and you can see in the URL to this page... http://sea-ax0038.davita.com:7777 / pls/fintest_apex/f? p = 130:26:6483666979470721:NO:P26_RU_TH_ID:13745

I have active debugging and it comes back with the following:

0.00227 0,18859 region: details of payment 4
review of the salon 0.00358 0,19093 4
0.00086 0,19451 determine the 4 column headers
0.00288 0,19527 enable sorting 4
0.00112 0,19818 analyze the query like: FINAPPS 4
0,19928-0.00121... Execute the statement: select NULL NULL "CHECK$ 01", 'RU_TD_ID': 'P14_RU_TH_ID' 'RU_TH_ID', NULL, 'FULL_ACCT_STRING', NULL, 'DETAIL_AMT', NULL, 'DETAIL_DESC', NULL, 'SERVICE_PERIOD', NULL, 'LOC', NULL, 'DEPT', NULL, 'ACCT', NULL, 'SUB', NULL "SPRT,' NULL 'DATE_ADD', NULL"USER_ADD', NULL, 'DATE_UPD', NULL, 'USER_UPD' of the union select double all ' CHECK$ 01 ","RU_TD_ID" , 'RU_TH_ID', 'FULL_ACCT_STRING', 'DETAIL_AMT', 'DETAIL_DESC', 'SERVICE_PERIOD', "LOC", "DEPT", 'ACCOUNT', "SUB", "SPRT", 'DATE_ADD', "USER_ADD", 'DATE_UPD', 'USER_UPD' of (select NULL "CHECK$ 01", "RU_TD_ID", "RU_TH_ID", "LOC", "DEPT", 'ACCT', "SUB", "SPRT", 'DETAIL_DESC', 'SERVICE_PERIOD', 'DETAIL_AMT', 'FULL_ACCT_STRING', 'DATE_ADD', "USER_ADD", 'DATE_UPD', 'USER_UPD' from (select 'RU_TD_ID' 'RU_TH_ID' ') , "LOC", "DEPT", "ACCOUNT", "SUB", "SPRT', 'DETAIL_DESC', 'SERVICE_PERIOD', 'DETAIL_AMT', 'FULL_ACCT_STRING', 'DATE_ADD', 'USER_ADD', 'DATE_UPD', 'USER_UPD' to 'FINAPPS '. ((' "RU_TRANS_DTL" where "RU_TH_ID" =: P26_RU_TH_ID) APEX$ RPTSRC order by 2 nulls first) 4
0,20053 0.00653 rename mentioned link "P14_RU_TH_ID" to "p$ _quoted_bind_1 ' 4
0,20706 0.00094 report error: ORA-01790: expression must have the same data type as the corresponding expression 4

The only thing that jumps, is where there the line "Rename city bind...". "I have no idea why is the reference 'P14_RU_TH_ID' in the select clause... it is P26 and was called from P11. In fact I do not understand why the whole of the union everything is generated wit the first part all the field of execept P14_RU_TH_ID NULL.

The other two regions on the page fill/processusent without problem.

Any help would be appreciated. We have improved the production 4.1 over the weekend and users missed test this feature and it is 'critical' (of course).

Thank you
Kristina

Published by: Kristina on February 13, 2012 21:01
Hi Kristina,

in fact, you should see a search box with the value 'Translational research' at the top right. When you click this field, the text will disappear and you can type in your search criteria. Press on [Enter] to run your search.

Concerning
Patrick
-----------
My Blog: http://www.inside-oracle-apex.com
APEX Plug-Ins: http://apex.oracle.com/plugins
Twitter: http://www.twitter.com/patrickwolf

APEX 4.1 Login page kills the existing session cookie

Similar Questions

URL of affected sites

Maybe you are looking for