Adding Allowed procedure breaks application

Question

My application was working fine. Then I added a custom procedure mypkg.myproc to allowed list of procedure under security tab. Then i could not access my application. It gives error "Requested url http://myserver/apex/f not allowed.
So i added "f" and "wwv_flow_custom_auth_sso*" and i could access the application. But all styling/images are gone and also submitting forms gives error "Requested url http://myserver/apex/wwv_flow not allowed".
So do i have to add all apex packages to the list if i want to add one custom package ? This seems wrong.. am imissing something here.. Please advise.
Listener version -1.0.2

Answer 1

Hi,
1. You need to list the apex packages in APEX Listener for Allowed Procedures, but you don't need the database validation for these packages. You don't need to define the Validation Function if you use the Allowed Procedures in the APEX Listener, you just double the check.
Anyway, as an example, you can easily use the function provided with APEX (wwv_flow_epg_include_mod_local in the APEX040000 schema) or see the one given in the Installation and Developers Guide (section "Configuring Security").
2. No, you can include them in your custom list when needed.
But again: If you plan to use APEX Listener for APEX and you use the Allowed Procedures, you don't need to configure the validation function.
The idea is:
Allowed Procedures = Whitelist - only the ones in there are allowed (including asterisks)
Blocked Procedures = Blacklist - procedures listed there are not allowed (can be combined with whitelist to exclude selected items from asterisk-inclusion)
These two are executed in that order in the APEX Listener itself.
Database Validation Function = gets the procedurename as parameter and returns boolean as result.
Basically, you'll do the same there as you can do with the APEX Listeners allowed/blocked feature, but you do it in the database. I think this is only relevant if you either run a mixed scenario (i.e., you use the same function for EPG or OHS/mod_plsql) or you want a more complex evaluation, e.g. you put some other environment variables like request IP address or some custom header into that evaluation in order to limit access to certain procedures just to intranet users or something like that.
-Udo