Impossible HttpOnly cookies with mod_plsql?

I noticed that OWA_COOKIE. SHIPMENT does not support the HttpOnly flag. So, I tried to do this manually generating the header 'Set-Cookie '. The problem is that something is clean up my Set-Cookie header, no matter what I do.

HTP.init;
HTP.p ("Set-Cookie: MY_COOKIE = TEST;") HttpOnly');
owa_util.http_header_close;
HTP.p ('hi!');
HTP. Flush;

Results in...

Set-Cookie: MY_COOKIE = TEST

In the response header. This does not work when I I run the PHP according to ESO similarly...

<? PHP
header ("Set-Cookie: MY_COOKIE = blah;") HttpOnly');
? >

Then I get...

Set-Cookie: MY_COOKIE = blah; HttpOnly

This driver, I think that the problem is in the htp.p procedure or perhaps mod_plsql. I searched on through the source for SYS. The HTP package and saw no such a code Set-Cookie disinfection system. This is why I suspect mod_plsql is responsible.

Here are some version information...
An error page 404 of the OHS reports... Oracle-Application-Server-10g/10.1.3.1.0 Oracle-HTTP-Server

Select double owa_util.get_version;

GET_VERSION
-----------
10.1.2.0.8

Apache version 2.0 (bundled with SST, don't know how to confirm the exact version)

Anyone know how to determine the version of mod_plsql?

I tried this PL/SQL block, as well a process page APEX and directly to a stored procedure. Both result in the leak. " HttpOnly"Strip. I noticed that any changes made to the case of the letters in the Set-Cookie is overridden and all other other that expires, domain, path and secure settings are deleted. It seems not to be possible for me to force a gross Set-Cookie header without this disinfection system that occur.

And here is the entrance to dads.conf...
< apex/pls/location >
PlsqlErrorStyle DebugStyle
Order deny, allow
Docs PlsqlDocumentPath
AllowOverride None
PlsqlDocumentProcedure wwv_flow_file_manager.process_download
PlsqlDatabaseConnectString captain.egg.com:1521:ssdev ServiceNameFormat
PlsqlNLSLanguage AMERICAN_AMERICA. AL32UTF8
PlsqlAuthenticationMode Basic
SetHandler pls_handler
PlsqlDocumentTablename wwv_flow_file_objects$
PlsqlDatabaseUsername APEX_PUBLIC_USER
Apex PlsqlDefaultPage
PlsqlDatabasePassword NothingToSeeHere
Allow all the
< / location >

Published by: Captain egg on July 8, 2010 23:38
Addition of dads.conf

I know this is an old post. I have the same problem. Find a soultion:

Owa_cookie package as:

   procedure send(name    in varchar2,
                  value   in varchar2,
                  expires in date     DEFAULT NULL,
                  path    in varchar2 DEFAULT NULL,
                  domain  in varchar2 DEFAULT NULL,
                  secure  in varchar2 DEFAULT NULL,
                  httponly in varchar2 DEFAULT NULL) is
...
...
...

                 IFNOTNULL(l_secure,  ' secure;') ||
                 IFNOTNULL(httponly,  ' HttpOnly'));

I have no idea why the manual says the httponly parameter is in cookie.send, when in fact he isn't here. So might as well add it. Then add it to the cookie.send () call.

Tags: Fusion Middleware

Similar Questions

  • I have 14 cookies with 0 bytes that settle 12-30-5000, how do I get rid of them?

    I have 14 cookies with 0 bytes that settle 12-30-5000, how do I get rid of them?

    In Windows, usually if you can find and see a file then right click with a mouse offers options including rename this file. Rename cookies.sqlite to something like cookies.sqlite. Old1 updates the file out of use; while leaving open the possibility to rename it and re-use it if necessary.

    The easiest way to find the file, (it is located in your Firefox profile) is to use:

    • Firefox Button-> help-> troubleshooting-> [folder opened] profile information

    Firefox will rebuild a file the correct name of the next time you restart Firefox. Delete or rename the files deletes cookies and that you continue to use the cookies of Firefox will be added and updated as usual.

  • HttpOnly cookie

    Hi all

    We try to add aditional security to a system based on the web which is headed by labview.  We run on gweb as a server and use labview to create cookies on the server side.  We want to impliment microsoft httponly cookie format.  Anyone know if this is possible?  the only examples that we have found to do this were other script languages, it appears, it can be as simple as adding information to the cookie header, but we cannot say for sure if this is the case and if so if it is possible to add this info using the vi LV cookie?

    Any help, or if someone has implimented it and could send a sample vi it would be greatly appreciated. (btw, we use LV 8.6)

    Chris

    PLATES

    Hi Chris,

    There is no entry to change the type of cookie, but you will be able to change the header information by digging into theCreat Cookie.vi. Double click the Subvi and you can change it.

    Flash

  • My computer microphone picks up sound at a very low volume. It is impossible to chat with no sound coming from my side! How should I do?

    My computer microphone picks up sound at a very low volume. It is impossible to chat with no sound coming from my side! How should I do?

    Buy a micro better use - one with noise suppression.  Sounds like inexpensive material.

  • 'Impossible to connect with the activation server' while trying to activate Windows 7

    Stater of the i run windows 7 on a laptop dell inspiron N5050 32-bit, windows asks me to re-enter my product key each tome I get it it displays after loading: impossible to connect with the activation server, see other ways to activate windows, pls make serious saying my trial period has expired why it cannot connect to the server to check the product key? Help, please

    Original title: activate windows

    Have you tried to restart by phone?

    How to activate Windows 7 manually (activate by phone)
     
    1) click Start and in the search for box type: slui.exe 4
     
    (2) press the ENTER"" key.
     
    (3) select your "country" in the list.
     
    (4) choose the option "activate phone".
     
    (5) stay on the phone (do not select/press all options) and wait for a person to help you with the activation.
     
    (6) explain your problem clearly to the support person.
     
    http://support.Microsoft.com/kb/950929/en-us

    Please run the Microsoft Genuine Diagnostics Tool then copy and paste the results into an answer here for further analysis:
    http://go.Microsoft.com/fwlink/?LinkId=52012

  • Error blackBerry software - synchronization failed, impossible to deal with organizing data

    I had a Q10 Blackberry last week.  I downloaded and installed the PC of Blackberry link 1.2.2.13 version.  Two-way sync USB worked fine.  Now, all of a sudden, I get the error message "synchronization failed, impossible to deal with organizing data."   I tried to reset the synchronization options, but not joy.  Also tried to uninstall and reinstall the software Link 1.2.2.13, once again no joy.  Any suggestions?

    UPDATE: I spent 4 hours on the phone and the remote session with the help of Blackberry last night.  After doing some troubleshooting to isolate the problem, determined that something on the device caused the problem of Outlook synchronization. One thing I've learned, it's that it can take a long time to synchronize and even though the progress of the screen may appear frozen, let it go until the end - sometimes it took 20-25 minutes, but eventually completed. Here's the process we went through - I would recommend appellant help BB and work with them to make sure you have not accidentally delete Outlook contacts and calendar of important information of your PC or BB device!.

    (1) we tried an uninstall/reinstall the PC Link BB software and that did not fix the problem.

    (2) to isolate the problem of synchronization.  We first did a synchronization of 2 channels 'contacts' and 'calendar' and who was a failure.  Then did a synchronization of only 2 channels 'contacts' and managed.  Then did a synchronization of only 2-way 'calendar' and that was a failure - so the problem was linked to calendar data and something on the device has been the cause of the problem or corrupted.

    (3) link BB allowing us to make a backup complete unit.

    4) then decided to do a 'Wipe security' on the device of BB Q10 to erase all the data and settings and return to a clean boot device configuration.  I was nervous about it - make double sure that Outlook all contacts and calendar data on the device and the PC are completely backed up in case something bad happens.  Nothing serious happened, but I was gald, we made the backup!

    (5) has the 'Security Wipe' feature (on the device, the settings > Security and privacy > wipe security) and phone rebooted without problems (takes a while to do).

    (6) then used link BB to do a sync test 1 channel 'contacts and calendar' from PC to device.  It worked without problem.

    (7) we then used BB link do a "restore" full backup of device, as we did in step 3 above.  It takes a while to make and was a success.

    (8) once the restoration of the aircraft was complete, BB link configured to perform a synchronization of 2 channels of the two 'contacts' and 'calendar '.  Does the synchronization and was a success.  Did a test by adding the new entry of the calendar on PC and did another 2-way sync - all worked very well.  Seems that the problem has been corrected, but will follow in the coming days.

    Lessons learned:

    (1) If you have a lot of Outlook contacts and calendar entries, the synchronization may take a long time.  Be patient and let it run - even if it seems stuck, etc!

    (2) save all Outlook data on the device and the PC to make sure that you have a backup something bad happened during troubleshooting.  We had not something bad happens, but I was gald we made a backup anyway.

    (2) call BB help - support person, I worked with was fabulous, even if it took some time to work through a patch.

     

  • What do need me for Oracle Http Server with mod_plsql on 64-bit Linux?

    I try to get ESS on a linux machine but I'm not sure that I install the correct thing!

    Currently I have a windows box running the server applications of 10 GB, but everything seems to have changed since then and there seems to be many different things to do with the Fusion Middleware and stuff. I tried to find an overview in English clear of what are all these things, but all I can find is a lot of marketing buzz words!

    All in need in order to run the ESO with the mod_plsql so I can run my apex application. I would be greatfull if someone could point me in the right direction for what I have to install!

    The box, that is happening is a CentOS Linux 64-bit computer. I download and installed Oracle WebLogic Server 11 g Rel (10.3.3) 1 by using the generic installer for the 64-bit java, but there seems to be no http server although they say there is! Most likely I'm doing something wrong but Setup is completed successfully, but nothing is running on port 7001.

    Do I really need the WebTier instead? What is the best solution for the execution of ESO with mod_plsql? I need the installation of WebLogic as well? Unfortunately, I'm pretty new to Linux as well which is not helping!

    Thanks for any help

    Robert

    Well, you have two options:
    -Use the distro of BCI WebTier utility SST. (Use 11.1.1.3 version, you need the two distributions 11.1.1.2 and 11.1.1.3)
    -Use the distro DB Companion Disk OSH.

    WebLogic Server is a Java EE application with an HTTP server included, but not intended to be used in replacement of OHS/Apache. It does not mod support

    HTH,
    -olaf

  • Cannot set the cookie with owa_cookie at APEX

    Hi all

    I'm trying to set a cookie in the same way as APEX done on the login page:
    Process page
    Type: PL/SQL anonymous block
    Point process: submit now - after calculations and Validations
    begin
    owa_util.mime_header('text/html', FALSE);
    owa_cookie.send(
        name=>'LOGIN_USERNAME_COOKIE',
        value=>lower(:P101_USERNAME));
    exception when others then null;
    end;
    I am able to read this cookie with owa_cookie.get and I'm able to show the value on the page.

    However, when I try to put a similar code on the actual page, it is not set the cookie. I get the message of success of the process of page , but there is no set of cookie. I tried this example hard-coded:
    begin
    owa_util.mime_header('text/html', FALSE);
    owa_cookie.send(
        name=>'TEST_USERNAME_COOKIE',
        value=>'Test_User');
    exception when others then null;
    end;
    I read the documentation of OWA_COOKIE, but that did not help. I also couldn't find anything in the user's Guide for the APEX.
    Can someone give me a clue on whqt that may be the reason?

    I work with DB 11 g and APEX 3.1.0.00.32.

    Thanks in advance, Wouter

    Wouter:

    I suspect that the HTTP header is re-initialized somewhere after your process page sets the cookie. Your page is supposed to the branch back to itself or branch to another page? Add these 2 lines of code for the cookie setting process. Adjust the value of "page_to_branch_to" as being suitable.

    apex_application.g_unrecoverable_error := true;
    owa_util.redirect_url('f?p=&APP_ID.:page_to_branch_to:&SESSION.');
    

    CITY

  • iOS 10 Mail app - threads are impossible to read with style answer-everything Outlook (without quotes)

    Outlook and the Mail app both old showed you a list of e-mails in a thread; If you want to dive to an email, you must click on this email.

    The new view of thread is essentially impossible to use now, since there is no view that shows each email in a list. Instead, if reply - all on your e-mail service does not add to citing it vertically and mark a horizontal line between the contextual emails, you end up seeing the WHOLE thread in each individual e-mail. It's 100% fine if you also have a vision where you can see every email truncated in a list. But this is no longer the case.

    I'm going to have to cut the wires completely from my computer (Outlook) is impossible for me to read in the current state.

    100% behind you! Please Apple, can we have an option to make the threads as they were in the iOS 9? It was actually a useful feature. In iOS 10, it is completely impossible / a lot of your time!

    Even if the quirks have been developed and e-mails would collapse correctly it is always not very useful when you have long filaments (which, when you use mail app for email to work can happen in the course of a single day with 20-30 + emails).

  • I can't delete cookies with this version of foxfire. I see not the button Delete. How to remove cookies?

    I was always able to delete cookies in Firefox. With the latest version, I don't see a delete button or move the slider to display a button Delete. How to delete cookies without a button actually remove visible?

    How do you remove usually cookies? In the Firefox Cookies dialog box, there are two buttons at the bottom: all delete and delete the selection. If you're used to a button Delete, it could be that you used an add-on to delete cookies.

    You can access the dialog box Cookies for the current site using the Page Info dialog box. Either:

    • Right click and select View Page Info > Security > "View Cookies".
    • (menu bar) Tools > Page Info > Security > 'view the Cookies '.
    • Click on the globe or padlock icon in the address bar > additional information > "View Cookies".

    In the dialog that opens, the site current is automatically entered in the top search box, so you can delete cookies from the site individually. If you want to see all THE cookies, you can disable this dialog.

    Does it work?

  • It is impossible to work with MS Word on ElCapitan.

    It is impossible to work in MS Word on my iMac. Whenever I touch the mouse, for some reason, I get the Kaleidoscope wheel that spins around and around during centuries (probably almost a minute - with EACH click of the mouse) before the action, in fact, I asked arrives.

    I close all other programs except Safari with no improvement. I have spare RAM.

    Is there something I can do?

    I have to add - my computer is around the age of 16 months, I run El Capitan, and I have the latest version of the programs Microsoft 2016.

  • "Cooking" with OSMF 2.0 and FMS 4.5.2

    One of the novelties of OSMF 2.0 and FMS 4.5.2 is the 'Best Effort get' and ability to 'Cook '. When the stream is made (i.e. ' Cook'), the client drive is expected to reach the end of the stream and then stop (done). Instead, he reaches the end of the data stream and goes into "buffering...". ». You can rewind the stream (mode DVR) and he's going to play very well again until it reaches the end.  I would like just flow at the end without the question of the "buffering...". ».  Any ideas?

    You will not be able to score a particular flow as done by issuing the command above. You must give the POST request with a request as a body:

    http:// /ctrlplane/livepkgr/_definst_/event-Name.f4m/done

    Body of the request:

    livestream2

    livestream3

    This will mark livestream2 and livestream3 associated with the name of the event as fact (and not the other channels).

  • Text box HTML with iframe fails with mod_plsql: apart from longer than 30

    Have a single region with the HTML page with source as:
    "< iframe src="\\hsidcs01a\import_files$\scanned_images\new\00000090\05001054.tif "height ="420"width ="700"> < / iframe >

    Download

    Your browser has requested that this server could not understand.

    mod_plsql: /pls/apexqa/\\hsidcs01a\import_files$\scanned_images\new\00000090\05001054.tif HTTP-400 name "\\hsidcs01a\import_files$\scanned_images\new\00000090\05001054.tif" has an extra share of 30 characters

    This only happens when I have the $ (hidden share drive).

    Tried various solutions such as incorporating the entire iframe in a report SQL (pl/sql to return) with the same error.  Also to put the URL of an ITEM with no luck.

    Help.

    Not sure I would------as those that are quite unusual for a web application. They assume that the end user has access to \\hsidcs01a\ and I think that support for these types of URI is only in IE, not Firefox / Chrome / Safari. You can map this drive on the HTTP server, and then create an alias for it if you use true http:// references?

    Tyler Muth
    http://tylermuth.WordPress.com
    [Oracle security application: development of secure database and Middleware environments | http://sn.im/aos.book]

  • Impossible to connect with exsisting last word, how can I change to a new password?

    I have 4 email accounts Thunderbird, all work except this one, the password that I noticed will not work. I would like to change a different password, but do not know how to do this. Thanks for any help

    Your password is your provider. To actually change the password that you would work with them.
    Go to the webmail providers page and see if your username and password will work here. If they do then if it is something other than the origin of the problem.
    If it is a gmail account, it might be their option of apps less secure that you need to activate.
    It could be the wrong server settings. Get an up-to-date list of your provider and check what you have in Thunderbird.

    You could try to erase the passwords stored in Thunderbird and returning to them.
    https://KB.wisc.edu/page.php?id=19006

  • "The store iTunes so impossible to deal with buy it now."

    Hello! I can't solve this problem, and he has to drive me crazy. Today I don't have use the iTunes Store and I did not try to buy anything. So I don't understand why I should read this banner every 3-5 minutes.

    How can I change it?

    Thank you for attention

    There is a problem with the stores, Apple needs to fix something on their end: https://www.apple.com/support/systemstatus/

Maybe you are looking for

  • Portege 7200 256 MB RAM - where?

    Hello Picked up a dirt cheap XP running Portege 7200, it currently has 128 MB of RAM, which I want to replace it with a 256 MB, where hell finding one that is not a price identical to a new portable computer? Thank you! Lee

  • Satellite L300D - need help to check if the adapter fits

    My adapter for my * Satellite L300D - 11A system unit * recently broke and the laptop will not load. I am resonably sure that the adapter is broken as the power to the adapter cord works, but the adapter for the laptop does not work. I found somethin

  • Continuous family security matters

    Hello A few moments ago, I had a problem with the parental control, which was being developed in the following discussion: -. http://answers.Microsoft.com/en-us/Windows/Forum/windows_other-security/family-safety-sign-in-hangs/99400114-4132-4bd5-9cdb-

  • Impossible to get updates, get the error "The Windows Installer Service could access."

    I use window Vista Home Basic. A few months I get the message "the Windows Installer Service could not be accessed. This can occur if Windows Installer is not installed properly. Contact your support team. I could not get updates for windows or my ad

  • Pavilion n209tx: driver for 3D video controller

    Use flag N209TX, 8.1, Nvidia Geforce 740 M victory 3D video controller PCI\VEN_10DE & DEV_1292 & SUBSYS_21DA103C & REV_A1PCI\VEN_10DE & DEV_1292 & SUBSYS_21DA103CPCI\VEN_10DE & DEV_1292 & CC_030200PCI\VEN_10DE & DEV_1292 & CC_0302 someone please send