APEX accessing ASP Session Cookie...?

Hi,
I'm trying to build an application to fit in with a pre-existing website.
This site authenticates users, setting appropriate session variables in a cookie. Then each asp page carries a script to check these session variables, denying access if they aren't correct.
I want my APEX application to fit in with this. Having read some of the documentation and browsed this forum, I'm thinking an open authentication application with an authorisation scheme based on these session variables.
My main problem is, how (if at all) I can get APEX to pick up on these session variables? I don't really want to start getting them out and sticking them in the URL used to call the application, because that would be a bit too easy to spoof.
Does anyone know a way of getting APEX to check a cookie and act on that? Or at least drag cookie variables over into its own session variables?
Cheers for any help.
Scott
P.S. It may show, I'm new to quite a lot of this!

Hello Scott,
>> Does anyone know a way of getting APEX to check a cookie and act on that?
APEX itself using cookies, utilizing a package called OWA_COOKIE. You can see an example on the login page (by default page 101) of your application.
You should check if the OWA_COOKIE package could help you with what you need.
Regards,
Arie.

Similar Messages

APEX Security: Multiple session cookies in one browser

Hi all,
I use mozilla firefox as web browser. When I open a new tab and enter the APEX application url I will be redirected to the login page. After successfully login I receive the session id and the browser the session cookie WWV_CUSTOM-F....
When I now open the next browser tab and enter the APEX application url I will be redirected to the login page. After successfully login I receive the new session id and the browser the session cookie WWV_CUSTOM-F... with new content. My session from the first browser tab will be killed, because the session cookie for this session was deleted/replaced by the session cookie from the second tab.
Is it possible to have multiple APEX sessions opened in one browser in multiple tabs?
Regards

Hi PaulP,
it's simple.
Unzip bsApex2 http://www.betasoftware.it/codice/bsApex2.zip
If not installed, install Microsoft .NET Framework 4 Client Profile.
Configure bsApex.exe.config
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<appSettings>
    
    <add key="aTitolo" value="Apex Desktop by Beta Software snc" />
    
    <add key="aTitoloBreve" value="Apex Desktop" />
    
    <add key="aAltezza" value="960" />
    
    <add key="aLarghezza" value="1200" />
    
    <add key="aChiudi" value="Close" />
    
    <add key="aStampa" value="Print" />
    
    <add key="aIcona" value="bsApex.ico" />
    
    <add key="aCliente" value="Apex Community" />
    
    <add key="aIndirizzo" value="http://apex.oracle.com/pls/otn/f?p=23873:1" />
</appSettings>
</configuration>Run bsApex.exe, that's all.
Regards,
Gianluigi

Apex session cookie in Safari

Hi all,
I'm hitting a restriction or security feature(?) of Safari in iOS. One of our Apex applications is a page that runs in an iframe on a site. Apex is installed on a server inside our own network and is accessable via dns: office.ourcorp.com (fake name, just to clearify the situation). We have a couple of different brands, that all have their own domains: brand1.com, brand2.com etc. All of these sites open the apex page inside an iframe.
That all works beautifully in all browsers, except in Safari in iOS. in iOS, the apex page isn't showing. It seams it's because of the session cookie Apex sets. Safari can't set an cookie from another domain (a cross domain cookie). Is there a possibility to turn off the session cookie?(ORA_WWV_APP_xxx)?
I also tried to set the 'cookie domain' option inside the authentication scheme to one of the domain names for our brands, but it still doesn't show up.
Does someone has a sollution?

I tried to do that. If you read my very first post in this thread, specifically "If I try to set a cookie in the page sentry function, it is breaking at the redirect line. Also, I don't think page sentry is the right place to set a cookie since it executes at every page.", I tried to set a cookie but it is throwing an error at the page.
I think all these complication is because I dont have a login page and I am using a HTTP header variable to validate the user. Given that, where should I set the cookie?
I also tried to do this:
- create an appliaction item called 'testuser'
- create an application computation to run 'before header' which sets the value of this to my HTTP header variable.
- When I retrieve the app item 'testuser' from a page, it is getting the correct value. But when I use this in the authentication scheme, it is returning null. Any idea why??
I know I am throwing a lot of questions. That is because I am trying a lot of approaches and each of them is posing a new set of challenges. I am actually looking for alternative ways to do what I am looking to do.
Thanks.
Shuba

Read asp-session or cookie

hi!
there's an asp-login page that holds a session with login information.
this asp page then calls my jsp page.
the problem is that i wanna access this login information stored in the asp-session from my jsp.
how can i archieve this?
is there a way to access to the asp-session or the cookie?
thx in advance

easiest way is to forward response from ASP (these ASP has to be invoked after the login form is submitted - post method) to JSP and get the required parameter
there are two possibilities
1) directly u get values of by request.getParameter("username")
0r
2) pass parameter and values from ASP page as myjsppage?username=test
hope these solve your probs...my prob is dukes...
bye for now
Pranav

Access Manager v7.1 - Sessions / Cookies

Is their a way to allow the user to open more than once session. Example: I login to web site "A" and access manager authenticates me and allows me in. Now I want to start a new tab to login to web site "A" as a different user. Currently I am unable to do that, when I go to the URL access manager has already been authenticated and allows me in. If I click logout it logs out of both browsers.
Currently the system act like the cookie are persistent. In v7.1.1 Sun added support for this but doesn't really talk about when to and not to use it. None of the realms are setup to use persistent cookies.
Any help is appreciated.......

The problem is not with the Access Manager. Your browser use the same session cookies for all tabs and windows. You must have two differents instances of the browser to have different session cookies. Try any other site and you will see the same thing.

Output from Flash to session cookies

Hi,
I'm a newbie as far as Flash is concerned. My background is
coding dynamic ASP 3.0 with ODBC connection to Access databases. I
have a number of educational programmes written in Flash that I
want to be able to track the progress of the student through each
scene so I can provide advanced reporting.
I am hoping the simplest solution ( not necessarily the best)
is to get each scene to write to the session cookie. I can use the
Global.asa file Session.end event to capture the output to write to
a database. I would like to write several variables for each scene
- course name, scene number, date & time.
All help appreciated

Hi Kglad,
Good news
- that sounds like an answer....
Did I say I was a newbie??!!
I really appreciate you help though. Is it possible to get a
paint by numbers answer?
I am hoping that I can add the needed action script at the
beginning of each scene.
Merry Christmas

How to Set up HTTPOnly and SECURE FLAG for session cookies

Hi All,
To fix some vulnerability issues (found in the ethical hacking , penetration testing) I need to set up the session cookies (CFID , CFTOKEN , JSESSIONID) with "HTTPOnly" (so not to access by other non HTTP APIs like Javascript). Also I need to set up a "secure flag" for those session cookies.
I have found the below solutions.
For setting up the HTTPOnly for the session cookies.
1] In application.cfc we can do this by using the below code. Or we can do this in CF admin side under Server Settings » Memory Variables
     this.sessioncookie.httponly = true;
For setting up the secure flag for the session cookies.
2] In application.cfc we can do this by using the below code. Or we can do this in CF admin side under Server Settings » Memory Variables
     this.sessioncookie.secure = "true"
Here my question is how we can do the same thing in Application.cfm?. (I am using ColdFusion version 10). I know we can do this using the below code , incase of HTTPOnly (for example).
<cfapplication setclientcookies="false" sessionmanagement="true" name="test">
<cfif NOT IsDefined("cookie.cfid") OR NOT IsDefined("cookie.cftoken") OR cookie.cftoken IS NOT session.CFToken>
<cfheader name="Set-Cookie" value="CFID=#session.CFID#;path=/;HTTPOnly">
<cfheader name="Set-Cookie" value="CFTOKEN=#session.CFTOKEN#;path=/;HTTPOnly">
</cfif>
But in the above code "setclientcookies" has been set to "false". In my application (it is an existing application) this has already been set to "true". If I change this to "false" as mentioned in the above code then ColdFusion will not automatically send CFID and CFTOKEN cookies to client browser and we need to manually code CFID and CFTOKEN on the URL for every page that uses Session. Right???. And this will be headache.Right???. Or any other way to do this.
Your timely help is well appreciated.
Thanks in advance.

BKBK wrote:
Abdul L Koyappayil wrote:
BKBK wrote:
You can switch httponly / secure on and off, as we have done, for CFID and CFToken. However, Tomcat automatically switches JsessionID to 'secure' when it detects that the protocol is secure, that is, HTTPS.
I couldnt understand this. I mean how are you relating this with my question.
When Tomcat detects that the communication protocol is secure (that is, HTTPS), it automatically switches on the 'secure' flag for the J2EE session cookie, JsessionID. Tomcat is configured to do that. Coldfusion has no say in it. So, for JsessionID, 'secure' is automatically set to 'false' when HTTP is detected and automatically set to 'true' when HTTPS is detected.
     If this is the case then why I am getting below info for jsessionid (As you mentioned it should set with SECURE flag . Right???). Note that we are using web server - Apache vFabric .And the application that we are using is in https and there is no hit is going from https to http.
Name:
JSESSIONID
Content:
782BF97F50AEC00B1EBBF1C2DBBBB92F.xyz
Domain:
xyz.abc.pqr.com
Path:
Send for:
Any kind of connection
Accessible to script:
No (HttpOnly)
Created:
Wednesday, September 3, 2014 2:25:10 AM
Expires:
When the browsing session ends
BKBK wrote:
2]When I checked CF Admin->Server Settings->Memory Variables I found that J2EE SESSION has been set to YES. So does this mean that do we need to set HTTPOnly and SECURE flag for JSESSIONID only or for CF session cookies (CFID AND CFTOKEN ) as well ?.
Set HTTPOnly / Secure for the session cookies that you wish to use. Each cookie has its pros and cons. For example, the JsessionID cookie is more secure and more Java-interoperable than CFID/CFToken but, from the explanation above, it forbids the sharing of sessions between HTTP and HTTPS.
     I understood that setting thos flags (httponly/secure) is as per my wish. But my question was , is it necessary to set those flags forcf session cookies (cfid and cftoken) as we have enabled J2EE session in CF admin?. Or in other way as the session management is J2EE based do we need to set those flags for CF session cookies?.
BKBK wrote:
3]If I need to set HTTPOnly and SECURE flag for JSESSIONID , how can I do that.
It is sufficient to set the HTTPOnly only. As I explained above, Tomcat will automatically set 'secure' to 'true' when necessary, that is, when the protocol is HTTPS.
     I understood that it is sufficient to set httponly only.but how we will set it for jsessionid?. This is my question. Apache vFabric will alos set secure to true automatically. Any idea??

Session Cookie in Servlet

Hi all
I have a issue please answer me.
If users disabled cookies.( other than session cookies)
how i should dynamically switch session cookies.
and how i can generate session cookies in servlet?
thanks
yashvant

If the user has cookies disabled (session, since persistent ones are rarely used for maintaining session state with a browser), then most containers will attempt 'url-rewriting' and insert the session uid there (in the URL). That should work even if cookies are disabled. In order to access a session, you simply call HttpServletRequest#getSession(). If no session exists, one will be created, else the existing one will be retrieved. The J2EE container will send either a cookie in the response or re-write the URL. You don't have to do anything special.
- Saish

Looking for sample code to decrypt MYSAPSSO2 session cookie

Hello,
I am looking for a sample code to decrypt MYSAPSSO2 session cookie and get the username out of it.

Hi Roy,
if you just need the username the easiest way is to grab the Cookie and Decode it using Base64. The username is contained in cleartext.
e.g.
MYSAPSSO2 Ticket as fetched from Browser:
AjExMDAgABFwb3J0YWw6bXRyaWNhcmljb4gAE2Jhc2ljYXV0aGVudGljYXRpb24BAApNVFJJQ0FSSUNPAgADMDAwAwADRDAxBAAMMjAwODA3MjUwNTA3BQAEAAAACAoACk1UUklDQVJJQ0%2F%2FAQUwggEBBgkqhkiG9w0BBwKggfMwgfACAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGB0DCBzQIBATAiMB0xDDAKBgNVBAMTA0QwMTENMAsGA1UECxMESjJFRQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDgwNzI1MDUwNzU5WjAjBgkqhkiG9w0BCQQxFgQUxUGK!5EDTrHQErPQCVJhEySzTBAwCQYHKoZIzjgEAwQvMC0CFQCD3K2A2hrgpNa5EceiDXjRN309ewIUTM3DJi8QTxmk%2FJez!rjnFlTM3BQ%3D
Decoded Ticket using Base64:
1100 uFFFD portal:mtricaricou02C6uFFFD basicauthentication uFFFD
MTRICARICO uFFFD 000 uFFFD D01 uFFFD 200807250507 uFFFD uFFFDuFFFDuFFFD
If you want to do it programmatically using any libraries to completely decode the ticket, check the validity and also access the certificate information inside the ticket you can use a SAP Extension called SAP SSOEXT (Goto service.sap.com/swdc and search for SSOEXT => The package also contains documentation and samples for various programming langauges such as JAVA).
This one needs dynamic libraries or shared libraries to be linked.
There also is a pure JAVA approach.
Have a look at this:
http://www.zope.org/Members/Dirk.Datzert/MySapSsoSupport/
But:
The approach of decrypting the cookie does not really make since when you are in a SAP system it is more intended for 3rd party systems in order to implement SSO.
Hope this helps
Cheers

Invalid session cookie supplied for session

Hi!
I am receiving this message in the jserver logs:
Invalid session cookie supplied for session test.site:1178135737779:-391743236040311715:2617822910155903052.
The operation will fail.
Repeat the request with a valid session cookie.
I can access the web client, i can start the vt420, but any other application that spawns a new browser windows fails. This is a standard install in Suse Linux.
Thanks in advance

I'm getting the same thing, and I know I shouldn't be. I've installed 4.2 many times, and even had 4.3 going on the Sun Ray server last week and it was fine. But now when trying to do a stand alone install, I can't seem to get past this.
Using Solaris x86, been working on this 2-3 days trying Sol10u3 no patches, latest patches, Xorg, Xsun, everything I can think of. I can't fathom why it worked on the exact same box, same OS.. (But it was running Sun Ray server software), and now with a fresh OS install, and it's doing this.
I also noticed it wanted to add itself to /home/ttasys/.ssh/known_hosts, I've never had a home directory for these users before. Made the home directory since I was fresh out of ideas, now it's just one less error message with the same result.

BC4J HTTP Container/session cookie time out

Hi,
We have a BC4J jsp app(developed in Jdev 9i Beta) deployed to oc4j 9ias. Every time the BC4J HTTP container and session cookie for the application time's out and a new instance of the application is invoked through a client browser, the RAM on the machine decreases. The fear is that the RAM will eventually fall to very low levels and adversely affect perfomance every time a time out occurs and a new instance of the application is invoked. When no time out's occur and new instances are invoked, the RAM is stable. The issue seems to be the time out's not releasing resources? The following is the message:
"BC4J HTTP container was timed out
The session cookie for the application, AdminAppModule, was timed out"
Any suggestions would be appreciated. Thanks in advance.

Please see response to other post at:
Access,Oracle Trusted Connection ODBC?
JR

Invalid session cookie on High latency wan connections

Hello,
I've had users at a remote site complaining that they are getting disconnected regularly from the SGD server here and are then unable to reconnect for several minutes. The connection is a GRE tunnel over the between sites with several firewalls and proxies in between. As well, the clients are behind a NAT. This is a standalone server SGD 4.41. As a test, I set up an SGD server at the remote location and logged into it. I've been disconnected twice at random intervals with a popup dialog that says "Invalid connection Cookie" Please contact your Administrator. In the webtop browser window I attempted a refresh which resulted in a Session Expired message in the webtop message window. I login again and I see my application session still there but upon attempting to connect to it I receive the following:
Web Service Request Failed
The following fault was returned from the server
Code Client.InvalidSessionCookie
String <cookie info etc...> for admin:runCommand
In a subsequent incident I received a popup with the message: The session already has a Secure Global Desktop Client Connection
Once this popped up my webtop session was hung and I could not log back in to the SGD server until I closed my browser and restarted it.
The connection has high latency 365+ ms and is notoriously unstable. Again there are multiple firewalls and proxies between the sites that I have no access to.
Error logs show the following:
Any ideas?
bash-3.00# less jserver988_error.log
2009/06/15 20:01:50.932 (pid 988) server/soapcommands/error #1245076310932
Sun Secure Global Desktop Software (4.4) ERROR:
Invalid session cookie supplied for session 1245075516671:servername:2172620047794735723:Li4uL191c2VyL2VwZWVsZXI=.
The operation will fail.
Repeat the request with a valid session cookie.
2009/06/15 20:07:25.691 (pid 988) server/soapcommands/error #1245076645691
Sun Secure Global Desktop Software (4.4) ERROR:
Unable to write message of type webserver for servername:1245068645735:-3969341831847819217.
Request will fail.
The user should close the Secure Global Desktop Client process, end the
session and start a new session.
2009/06/15 20:07:28.867 (pid 988) server/soapcommands/error #1245076648867
Sun Secure Global Desktop Software (4.4) ERROR:
Invalid session cookie supplied for session 1245075516671:servername:2172620047794735723:Li4uL191c2VyL2VwZWVsZXI=.
The operation will fail.
Repeat the request with a valid session cookie.
2009/06/15 20:08:32.384 (pid 988) server/soapcommands/error #1245076712384
Sun Secure Global Desktop Software (4.4) ERROR:
Invalid session cookie supplied for session 6543220712367266453:servername:1245068645735:-3969341831847819217:1.
The operation will fail.
Repeat the request with a valid session cookie.

Hi DalamarUK83,
"I have seen posts about disabling VMQ on the host/guest servers as there may be an issue with this model - this has had no effect at all, the issue persists after changing VMQ and restarting both the guest and the host OS."
Did you disable the feature in advanced settings of physical NICs ?
I would suggest to re-create virtual switch after disabling VMQ .
What is the make of that NIC ?
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Session Cookie JSESSIONID - can this be re-named?

Hello
We are currently implementing EP7 within our organisation. We are going to use the IBM Tivoli Access Manager (TAM) to Single Sign On to the Portal. This I have working OK. I have a problem where 99% of the times certain content does not appear. I keep getting an error from TAM mentioning that there was an unexpected error.
I have read the following from the IBM site http://www-1.ibm.com/support/docview.wss?uid=swg21288017 where they mention that modifying the cookie name JSESSIONID on websphere portal to "JSESSIONID2" will fix the problem. I want to implement a similar change on EP7. I want to change the name of the session cookie JSESSIONID to something else - like JSESSIONID2. My question is - is this possible. If so then how would you go about it. I have checked everywhere in Visual Administrator and have been unsuccessful so far.
Points will be awarded for useful information.
Thanks in Advance
Rajdeep

Show us the page, please.
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.dreamweavermx-templates.com
- Template Triage!
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
http://www.macromedia.com/support/search/
- Macromedia (MM) Technotes
==================
"RTalbott" <[email protected]> wrote in
message
news:esscul$p9m$[email protected]..
> Hi experts,
> I have a template with a div designated as an editable
region.
>
> In a page linked to the template, when I cut and paste
from a Word
> document,
> into the Code Window, or when I try to edit in the Code
Window,
> Dreamweaver
> tells me that I have tried to make changes to a region
that is not
> editable,
> and that if I update the template later, my changes will
disappear. The
> message asks if that's okay.
>
> Even if I say yes, DW sometimes deletes my changes when
I click on the
> Design
> Window.
>
> If I cut and paste or edit in the Design Window
directly, DW does not
> object.
>
> Is this normal? I think it should not be, based on the
fact that this
> behavior is very awkward, and also, the problem seemed
to have disappeared
> in
> the past, perhaps when I closed and re-opened DW. It has
reappeared in my
> current session.
>
> Any ideas as to what's going on, and how to fix it if it
is abnormal?
>
> Thanks so much for any advice
> Richard
>

Weblogic.httpd.session.cookies.enable not working in WLS4.5 sp 11 ?

I want to disable the use of cookies in WLS 4.5, and set the following
weblogic.httpd.session.cookies.enable=false
In WLS 4.5 sp7, this correctly prevents the server from using cookies
for session-tracking, forcing the extraction of the session id from a
rewritten URL.
However, for WLS 4.5 sp11 cookies are still sent from the server
Is this a known issue ?
jo

I want to disable the use of cookies in WLS 4.5, and set the following
weblogic.httpd.session.cookies.enable=false
In WLS 4.5 sp7, this correctly prevents the server from using cookies
for session-tracking, forcing the extraction of the session id from a
rewritten URL.
However, for WLS 4.5 sp11 cookies are still sent from the server
Is this a known issue ?
jo

Can portal session cookies be used between two data centers

OAS generates the following header information and session information for my application. However when I need to failover the originating OAS datacenter into my hot stand-by for maintenance or upgrades, the OAS in the other datacenter responds with a 503 web error. We are using Akamai's GTM to manage the liveness of the datacenter, so we would need the hot stand-by OAS portal in that datacenter to return a 302 error code. Is there some method that we can add to our portal application which would always return a 302 error code.
See header information collected through wfetch. The 503 error is caused by the hot stand-by data center not accepting or recognizing the cookie. Both OAS datacenters are IDENTICAL in Oracle levels, application levels, web servers, portals and OS patches.
resolve hostname "170.107.183.32"WWWConnect::Connect("170.107.183.32","80")\nsource port: 2182\r\n
GET /portal/pls/portal/PORTAL.wwsec_app_priv.login?p_requested_url=%2Fportal%2Fpls%2Fportal%2FPORTAL.home&p_cancel_url=%2Fportal%2Fpls%2Fportal%2FPORTAL.home HTTP/1.1\r\n
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)\r\n
Host: www.thomson-pharma.com\r\n
Connection: Keep-Alive\r\n
Cookie: ORA_WX_SESSION="10.225.8.30:80-1#2"; portal=9.0.3+en-us+us+AMERICA+3D66674E7EED0801E04400144F41424E+BBAA98EEB32D58C086231A8D6CBE2E5D402D89B0E79D83A18C668BB0CA7417B4044DEA389C8B50DD37D9272A24B4753B22F29978861DE14503F8B9BEDC2014654B26A434CF074F4D8749B88610ADADF5084A90ADBF749E2A; DATACENTER=EAGAN\r\n
\r\n
HTTP/1.1 503 Service Unavailable\r\n
Cache-Control: private\r\n
Content-Type: text/html\r\n
Set-Cookie: ORA_WX_SESSION="10.237.138.33:80-1#2"\r\n
Set-Cookie: portal=; expires=Wednesday, 27-Dec-95 05:29:10 GMT; path=/\r\n
Connection: Keep-Alive\r\n
Keep-Alive: timeout=5, max=999\r\n
Server: Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=208440262161,0)\r\n
Content-Length: 710\r\n
Date: Fri, 26 Oct 2007 14:58:07 GMT\r\n
\r\n
Thanks -John

Hi John,
This question is probably more appropriate in one of the Portal forums, but perhaps you can take a look at the information in section C.5 Configuring the Portal Session Cookie in Appendix C of the Portal Configuration guide.
Here is a link: http://download.oracle.com/docs/cd/B14099_19/portal.1014/b19305/cg_app_c.htm#sthref1907
Regards,
Peter

APEX accessing ASP Session Cookie...?

Similar Messages

Maybe you are looking for