Logged Out session can be accessed again After logout (DAD authentication)

Question

Hello,
Please find the details of my problem below:
SCENERIO:
Current Authentication: No Authentication (USING DAD)
Authorization: MYAUTH
Frequency: Once Per Session
declare
lv_retval boolean;
lv_srec pkg_myutil.r_sessionrectype;
begin
begin
-- This is NOT Apex Session. I am checking the entry in a table to make sure user is logged in
-- and the link is not opened directly. In short making sure user opened the Apex link from the
-- Oracle Forms application.
lv_srec :=pkg_myutil.get_session_info(:P1_SID);
if lv_srec.valid_session then
lv_retval := TRUE;
else
lv_retval := FALSE;
end if;
exception
when others then
lv_retval := FALSE;
end;
return lv_retval;
end;
The Application Security property Authorization is set to : MYAUTH
Logout Navigation Bar Entries-URL TARGET: http://myapp.mycompany.com/pls/apex/apex_custom_auth.logout?p_this_app=105&p_next_url=http://mycompany.com
( I cannot put this in the Authentication Logout URL as using -DATABASE- as sentry function (DAD authentication) gives me error: No functional attributes may be set when page sentry function is '-DATABASE-'.))
so i directly modified the navigation bar entry
Now I open the apex link from my forms application, and it Works fine. For example
http://myapp.mycompany.com/pls/QRYONLYDAD/f?p=105:1:2524984933940261::NO::P1_SID:0137099300:
The authorization function takes the P1_SID value and checks in database,finds the entry so returns TRUE to display the page 1 which i call Menu page.
If I click logout, it works and takes me to the Mycompany home page.
My question:
If save that link and try to access it again AFTER LOGOUT, it still displays the page. Although the session is logged out, how come it still allows to access the page? The authorization function also doesn't fire which would have prevented it atleast. How APEX knows it still a valid session even after logout happens?
I can see that Since there is DAD authentication, the login happens automatically........ but I cannot change that method. What other option do i have?
Please help.
Jay

Answer 1

1.) Code for the function:
Basically we are using a private DBMS_PIPE to pass a randomly generated string and read that pipe from Apex using get_session_info. Nothing to do with Apex Session. We just want to make sure the user opened the Apex link from the application.
function get_session_info (p_session_id varchar2) return pkg_myutil.r_sessionrectype is
rv_sessionrec eft.pkg_myutil.r_sessionrectype;
lv_status NUMBER;
lv_app_id varchar2(20);
lv_EMPID VARCHAR2(20);
lv_timeout BINARY_INTEGER := 0; --A timeout of 0 allows you to read without blocking. otherwise the pipe will keep waiting and our purpose won't be solved
lv_rmstatus number;
begin
begin
-- Valid Session theme: If the pipe doesnot exist means the url is not requested from inside the Forms application.
lv_status := DBMS_PIPE.RECEIVE_MESSAGE(p_session_id,lv_timeout);
IF lv_status <> 0 THEN
raise_application_error(-20003,'Error while receiving.Status = ' || lv_status);
END IF;
DBMS_PIPE.UNPACK_MESSAGE(lv_app_id);
DBMS_PIPE.UNPACK_MESSAGE(lv_EMPID);
if lv_EMPID is null then
raise_application_error(-20004,'User EMPID is null in the session info.');
end if;
-- construct return record
rv_sessionrec.session_id:=p_session_id;
rv_sessionrec.valid_session :=TRUE;
-- remove pipe
lv_rmstatus:=DBMS_PIPE.REMOVE_PIPE(p_session_id);
if lv_rmstatus <> 0 then
null; -- think what to do
end if;
exception
when others then
rv_sessionrec.session_id:=p_session_id;
rv_sessionrec.valid_session :=FALSE;
end;
return rv_sessionrec;
end get_session_info;
2.) I guess you are right. But doesn't Apex use the Userid and password hardcoded in the DAD? because it displays the username in DAD on the page footer. But It will authenticate everytime. So I want to put another layer so that my pipe verification code executes everytime which can decide whether to show the page or redirect to a error page.
If i put in a On-Load Before Header Process on Page 1 with the pl/sql code, is there a way there to redirect to different page? I couldn't think of a way to do it. Then i can remove the code from authorization scheme and add to the On-Load process?
Does this help any?
Thanks for your prompt response.
Thanks,
Jay