I want to remove / hide session ID from the URL in Oracle APEX

Parita

PL Refer Screenshort of URL.

I am new to oracle apex PL guide me what to do & how to do.

Thanks in Advance😄

Scott Wesley

Why would you like to remove it?

Parita

Hi @Scott Wesley

Because in security check this will come as an issue & we have to fix this so.

AndyH

Who thinks it's a security issue? Why?

Faadi

We are facing the exactly same issue, our security ask the same question.

I appreciate if you could share your solution or any one have it one on it.

AndyH

https://community.oracle.com/tech/developers/discussion/comment/16821417#Comment_16821417

But has your security told you why they think that this is a security issue?

Naser El Sayed

The following was the comments

Sensitive data like session id should not be passed through URL, Its should be pass through only cookie headers.

Impact

An malicious user may observe the data/session passing though in the same network

User_1VRBN

We are facing the exactly same issue, our team encounters the same reaction

I appreciate if you or any official can throw some light on it.

AndyH

Sensitive data like session id should not be passed through URL, Its should be pass through only cookie headers.

There is no security issue in the use of the session id in the URL as the cookie that is also sent to the client has details that must also match that session id - the session cannot be hijacked by another user.

Perhaps your security team could review the online documentation e.g. https://docs.oracle.com/en/database/oracle/application-express/21.2/htmdb/understanding-session-state-management.html#GUID-CE2A38B5-75B7-4C43-ACB0-685E16C6ACF9

User_1VRBN

Thanks .. will go through it.

https://community.oracle.com/tech/developers/discussion/comment/16821529#Comment_16821529

Scott Wesley

Perhaps if the security team could demonstrate how to hijack the session using the session ID, then hiding the value from the URL would be a valid pursuit. But until that happens...