Search code examples
oracleoracle-apexapex

Oracle Apex Security HTTP-ONLY


Our client has some application security requirements before they allow our application to be published. One of the requirements is to enable HTTP-ONLY attribute so that the cookie cannot be accessed through the client side script. And enable the SECURE attribute to disallow the cookie to be sent over an unencrypted channel. I am new to Oracle Apex Security settings. Can someone help on how to set this? Oracle Apex version is 21.1. Workspace Admin only.


Solution

  • These cookie attributes should be set by APEX automatically. HTTP Only is always set since newer APEX releases and the secure attribute is only set when your app or environment runs under HTTPS.

    You can check that with the help of your browser dev tools.

    In Chrome:

    Open Dev Tools > Application Tab > Cookies (your domain) > List of cookies with all attributes and values

    Should look like this:

    Oracle APEX cookies