Search code examples
oauthoracle11goauth-2.0oracle-apexrestful-authentication

Disable security verify SSL in oracle apex

I'm using Oracle Application Express 11g.

To secure RESTful services I want to create Third Party Authentication for it.

According to this article : http://www.oracle.com/technetwork/developer-tools/rest-data-services/documentation/listener-dev-guide-1979546.html

In order to register my third party user I need to access this url : https://server:port/ords/resteasy/ui/oauth2/clients/ as I don't have SSL every time I face this error(entring the url in http) :

403-Forbidden

  • This resource must be accessed over HTTPS only

The Question is : how can I disable "security verify SSL" in apex, in order that I never face this error again.

Note that there is no error like this in other pages because I'm not forced to use https, and I'm receiving this error entring the url in http.

Solution

  • https://docs.oracle.com/cd/E37099_01/doc.20/e25066/install.htm#AELIG7183

    1.4.5 Using OAuth2 in Non HTTPS Environments

    RESTful Services can be protected with the OAuth2 protocol to control access to nonpublic data. To prevent data snooping, OAuth2 requires all requests involved in the OAuth2 authentication process to be transported using HTTPS. The default behavior of Oracle REST Data Services is to verify that all OAuth2 related requests have been received using HTTPS. It will refuse to service any such requests received over HTTP, returning an HTTP status code of 403 Forbidden.

    This default behavior can be disabled in environments where HTTPS is not available as follows:

    1. Locate the folder where the Oracle REST Data Services configuration is stored.

    2. Edit the file named defaults.xml.

    3. Add the following setting to the end of this file just before the </properties> tag.

       <entry key="security.verifySSL">false</entry>

    4. Save the file.

    5. Restart Oracle REST Data Services if it is running.

    Note that it is only appropriate to use this setting in development or test environments. It is never appropriate to use this setting in production environments because it will result in user credentials being passed in clear text.