Hands-On Oracle Application Express Security

Chapter 1

Access Control

One of the most basic forms of protection that any web application must utilize is the enforcement of an authentication and authorization policy.

Authentication deals with identifying users to the application; in APEX this is provided by a number of default authentication schemes and can be extended using a custom authentication scheme. Authorization is the process of assessing whether the authenticated user is privileged to access certain data or perform a particular action.

The term access control covers both aspects, and access-control vulnerabilities arise when either authentication can be abused to allow access to an application without valid credentials, or when authorization is incorrectly applied, allowing valid users to access parts of the application for which they should not have privileges.

One of the great things about APEX is the capability to apply authorization schemes to a wide range of components. At a simple level, pages within an APEX application can be protected by your authorization scheme to prevent access to certain sets of users. The applicability of authorization schemes is a lot more granular: reports, buttons, and processes can all also be protected. Users with different privileges can then only view or access specific components on a page. While APEX provides a great access control model, there are some common mistakes that are made where data and functionality do not get protected as you might expect. This chapter will guide ...