Configuring Security

Control if a convenience cookie is sent to a user's computer whenever a developer or administrator logs in to a workspace from the Application Express Login page.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. For Set Workspace Cookie, select No.

   • Yes - Enables the Application Express workspace login page to send a persistent cookie containing the last used workspace name and username combination.

     This cookie has a lifetime of six months and is used to populate the Workspace and Username fields of the Application Express workspace login form (not the Service Administration login form).

   • No - Prevents this cookie from being sent.
6. Click Apply Changes.

Prevent a user from logging in to Oracle Application Express Administration Services.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. For Disable Administrator Login, select Yes.

   Note:

   Selecting Yes and signing out prevents anyone from accessing Oracle Application Express Administration Services.

6. Click Apply Changes.

If access to Oracle Application Express Administration Services has been disabled, an Instance administrator can re-enable again by running the following SQL statements.

1. Connect in SQL*Plus and connect to the database where Oracle Application Express is installed as SYS, for example:

   • On Windows:

     SYSTEM_DRIVE:\ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

   • On UNIX and Linux:

     $ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

2. Run the following statement:

   ALTER SESSION SET CURRENT_SCHEMA = APEX_180100;
   

3. Run the following statement:

   BEGIN
     APEX_INSTANCE_ADMIN.SET_PARAMETER('DISABLE_ADMIN_LOGIN', 'N');
     commit;
   END;
   /
   

Restrict user access to Application Express by disabling workspace login. Disabling workspace login in production environments prevents users from running Application Express applications such as App Builder, SQL Workshop, Team Development, and Workspace Administration.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. From Disable Workspace Login, select Yes.

   Selecting Yes effectively sets a Runtime-Only environment while still allowing Instance administrators to sign in to Instance Administration. Selecting Yes in production environments prevents developers from changing applications or data.

6. Click Apply Changes.

Use the Allow Public File Upload attribute to control whether unauthenticated users can upload files in applications that provide file upload controls.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. From Allow Public File Upload, select one of the following:

   • Yes - Enables unauthenticated users to upload files in applications that provide file upload controls.

   • No - Prevents unauthenticated users from uploading files in applications that provide file upload controls.

6. Click Apply Changes.

Restrict user access to an Oracle Application Express instance by specifying a comma-delimited list of allowable IP addresses.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. For Disable Administrator Login, select No.
6. In Restrict Access by IP Address, enter a comma-delimited list of allowable IP addresses. Use an asterisk (*) to specify a wildcard.

   You can enter IP addresses from one to four levels. For example:

   141, 141.* ...
   192.128.23.1 ...
   

   Note:

   When using wildcards, do not include additional numeric values after wildcard characters. For example, 138.*.41.2.

7. Click Apply Changes.

Configure an entire Oracle Application Express instance to use a proxy for all outbound HTTP traffic.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. In Instance Proxy, enter the address of the proxy to be used for the entire instance. In No Proxy Domains, enter a list of domains, for which the proxy server should not be used.
6. Click Apply Changes.

Select a hash function that Application Express uses to generate one way hash strings for checksums.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. From Checksum Hash Function, select a a hash function that Application Express uses to generate one way hash strings for checksums.

   The SHA-2 algorithms are only supported on Oracle Database 12c or later. Most Secure automatically selects the most secure algorithm available. Therefore, Oracle recommends this setting. On Oracle Database 12c or later, this evaluates to SHA-2, 512 bit and on Oracle Database 11g, SHA-1 is the most secure algorithm. Since the MD5 algorithm is deprecated, Oracle does not recommend this setting.

6. Click Apply Changes.

Control if Oracle Application Express supports application URLs that do not contain session IDs. 

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. From Rejoin Sessions, select an option:
   • Disabled - If the URL does not contain a session ID, Oracle Application Express creates a new session.
   • Enabled for Public Sessions - If the URL goes to a public page and does not contain a session ID Application Express attempts to utilize the existing session cookie established for that application. For applications with both public and authenticated pages, a session ID is defined after the end user authenticates. Application Express only joins via the cookie when the session is not yet authenticated.
   • Enabled for All Sessions - If the URL does not contain a session ID, Oracle Application Express attempts to use the existing session cookie established for that application, providing one of the following conditions are met:

     • Session State Protection is enabled for the application and the URL includes a valid checksum. For public bookmarks, the most restrictive item level protection must be either Unrestricted or Checksum Required - Application Level.

     • The URL does not contain payload (a request parameter, clear cache or data value pairs). This setting requires that Embed In Frames is set to Allow from same origin or to Deny for the application.

     Enabled for All Sessions requires that Embed in Frames is set to Allow from same origin or Deny. This is not tied to a condition about the URL payload, but also applies to session state protected URLs.

6. Click Apply Changes.

Control how Oracle Application Express displays the results of unhandled errors

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate the Security section.
5. From Unhandled Errors, select an option:

   • Show Error Page - This is the default behavior. For any error or exception which is not handled by the error processing of an application, an error page displays to the end user with the specific error and the error code.

   • Return HTTP 400 - Returns an HTTP 400 status to the end user's client browser when the Application Express engine encounters an unhandled error.

6. Click Apply Changes.

Configure both the Oracle Application Express instance and all related applications to require HTTPS by configuring the Require HTTPS and Require Outbound HTTPS attributes.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Under HTTP Protocol, configure the following:
   1. Require HTTPS:

      • Always - Enforces HTTPS for all applications (including the Oracle Application Express development and administration applications) to require HTTPS.

        If set to Always, the Strict-Transport-Security Max Age attribute displays. Use this field to specify the time period in seconds during which the browser shall access the server with HTTPS only. To learn more, see field-level Help.

      • Development and Administration - Forces all internal applications within Oracle Application Express (that is, App Builder, SQL Workshop, Instance Administration and so on) to require HTTPS.

      • Application specific - Makes HTTPS dependent on application-level settings.

   2. Require Outbound HTTPS - Select Yes to require all outbound traffic from an Application Express instance to use the HTTPS protocol.
   3. HTTP Response Headers - Enter additional HTTP response headers that Oracle Application Express should send on each request for all applications. Developers can specify additional headers at application-level. Each header has to start on a new line. Note that support for various headers differs between browsers. To learn more, see field-level Help.
5. Click Apply Changes.

If you enable Reverse HTTPS, an Instance administrator can disable it by running the following SQL statements.

1. Connect in SQL*Plus or SQL Developer with the Application Express engine schema as the current schema, for example:

   • On Windows:

     SYSTEM_DRIVE:\ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

   • On UNIX and Linux:

     $ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

2. Run the following statement:

   ALTER SESSION SET CURRENT_SCHEMA = APEX_180100;
   

3. Run the following statement:

   BEGIN
       APEX_INSTANCE_ADMIN.SET_PARAMETER('REQUIRE_HTTPS', 'N');
       commit;
   end;
   /
   

If you enable Require Outbound HTTPS, an Instance administrator can disable it by running the following SQL statements.

1. Connect in SQL*Plus or SQL Developer with the Application Express engine schema as the current schema, for example:

   • On Windows:

     SYSTEM_DRIVE:\ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

   • On UNIX and Linux:

     $ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

2. Run the following statement:

   ALTER SESSION SET CURRENT_SCHEMA = APEX_180100;
   

3. Run the following statement:

   BEGIN
       APEX_INSTANCE_ADMIN.SET_PARAMETER('REQUIRE_OUT_HTTPS', 'N');
       commit;
   end;
   /
   

Enter additional HTTP response headers that Oracle Application Express should send on each request, for all applications.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Locate HTTP Protocol.
5. In HTTP Response Headers, enter additional HTTP response headers that Oracle Application Express should send on each request for all applications.

   Developers can specify additional headers at application-level. Each header has to start on a new line. Support for various headers differs between browsers.

   One important security related header is Content-Security-Policy. Sending this header can significantly reduce the risk of cross site scripting (XSS) and related attacks. To learn more, see field-level Help.

6. Click Apply Changes.

Isolating workspaces is an effective approach to preventing browser attacks.

The only way to truly isolate a workspace is to enforce different domains in the URL by configuring the Allow Hostnames attribute. When the URLs of the attacker and the victim have different domains and hostnames, the browser's same-origin policy prevents attacks.

Configure isolation and resource limitation default values for all workspaces. Workspace administrators can override these default values at the workspace-level.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Under Workspace Isolation, configure the following attributes:

   Tip:

   To learn more about an attribute, see field-level Help.

   Table 2-3 Workspace Isolation Attributes

   Attribute	Description
   Allow Hostnames	Enter a comma separated list of hostnames that can be used to access this instance. This attribute can be used to specify which DNS aliases of the web server can be used with applications. You can configure specific values that override this one at workspace level. If you enter one or more hostnames, the incoming HTTP request URL's hostname part must match one of the listed hostnames.
   Resource Consumer Group	Specify the Database Resource Manager consumer group to be used for all page events on the instance. You can configure specific values that override this one at the workspace-level. At the beginning of every request, the Application Express engine switches the current consumer group of the current database session to the consumer group that is defined at workspace or instance level. This applies to both executing applications and any of the applications used within the Application Express development environment. The privilege to switch to this consumer group must be granted to either PUBLIC or the Application Express schema. This privilege is typically granted using the procedure DBMS_RESOURCE_MANAGER_PRIVS.GRANT_SWITCH_CONSUMER_GROUP.
   Maximum Concurrent Workspace Requests	Enter the maximum number of concurrent page events that Oracle Application Express supports for all applications. You can configure a specific value at the workspace-level. Instead of processing a page event, Oracle Application Express shows an error message when the limit is already reached. Oracle Application Express keeps track of workspace requests by querying the CLIENT_INFO column of GV$SESSION. This tracking will not work if developers overwrite CLIENT_INFO, for example, with a call to DBMS_APPLICATION_INFO.SET_CLIENT_INFO.
   Maximum Concurrent Session Requests	Enter the maximum number of concurrent page events that Oracle Application Express supports for each session for applications in this instance. You can configure a specific value at the workspace-level. Instead of processing a new page event, Oracle Application Express shows an error message when the limit is already reached. Alternatively, you can use the Concurrent Session Requests Kill Timeout attribute to kill an active database session, to process the new page event. Oracle Application Express keeps track of session requests by querying the CLIENT_IDENTIFIER column of GV$SESSION. This tracking will not work if developers overwrite CLIENT_IDENTIFIER, for example, with a call to DBMS_SESSION.SET_IDENTIFIER.
   Concurrent Session Requests Kill Timeout	If a new page event comes in that is outside the limits of Maximum Concurrent Session Requests, Oracle Application Express can execute alter system kill session on the oldest active database session which processes another page event for this Application Express session. The Concurrent Session Requests Kill Timeout attribute specifies the number of seconds a database process has to be active, before it can be killed. If you leave this attribute empty, Application Express will not kill any database sessions. Warning: Killing sessions can cause problems with the application server's database session pool.
   Maximum Size of Files in Workspace	Enter the total size (in bytes) of all files that can be uploaded to a workspace. You can configure a specific value at the workspace-level.
   Maximum Web Service Requests	Enter the maximum number of web service requests that Application Express supports for each workspace in this instance. You can configure a more specific value at the workspace-level.

5. Click Apply Changes.

Administrators can configure authentication controls for an entire instance or for each individual workspace.

Configure developer and end user login security settings.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Under General Settings, configure the following attributes:
   1. Delay after failed login attempts in Seconds - After failed logins, Oracle Application Express displays a countdown of this number times the number of failed login attempts, before it accepts new login attempts with the same username. Enter 0 to disable the countdown and allow immediate access.
   2. Method for computing the Delay - Select a method for computing the delay for failed log ins. The computation methods are based on recent data in the Login Access Log.
      See item help for further details.
   3. Inbound Proxy Servers - Enter a comma-separated list of IP addresses for well known proxy servers, through which requests come in. Oracle Application Express uses this list to compute the actual client address from the HTTP Headers X-Forwarded-For and REMOTE_ADDR.
   4. Single Sign-On Logout URL - Enter the URL Application Express redirects to trigger a logout from the Single Sign-On server. Application Express automatically appends ?p_done_url=...login url....
5. Click Apply Changes.

Manage security settings for workspace administrator and workspace developer accounts.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Under Development Environment Settings,, configure the following attributes:
   1. Username Validation Expression - Enter a regular expression to validate the usernames of developers and administrators. Enter * to bypass the validation. The following example validates that the username is an email address:

      ^[[:alnum:]._%-]+@[[:alnum:].-]+\.[[:alpha:]]{2,4}$

   2. Require User Account Expiration and Locking - Applies to end user accounts created using the Oracle Application Express account management interface. Select Yes to enable Application Express user account expiration and locking features across all workspaces. This selection prevents the same feature from being disabled at the workspace-level. Select No to relinquish control to each Workspace administrator. 
   3. Maximum Login Failures Allowed - Enter a integer for the maximum number of consecutive unsuccessful authentication attempts allowed before a developer or administrator account is locked. If you do not specify a value in this field, the default value is 4.

      This setting applies to administrator and developer accounts. It does not apply to end user accounts. The value you enter is used as the default for the workspace-level Maximum Login Failures Allowed preference if the Workspace administrator does not specify a value. That preference is used for end-user accounts within the respective workspace.

   4. Account Password Lifetime (days) - Enter a number for the maximum number of days a developer or administrator account password may be used before the account expires. If you do not specify a value in this field, a default value is 45 days.

      This setting applies to accounts used to access the Application Express administration and development environment only. It does not apply to end user accounts. The value you enter is used as the default workspace-level End User Account Lifetime preference which workspace administrators can change. The workspace-level preference applies to the accounts within that workspace.

5. Click Apply Changes.

Manage development environment authentication schemes.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Scroll down to Development Environment Authentication Schemes.
5. Click the Edit icon adjacent to the authentication scheme you wish to edit.
6. Edit the appropriate attributes. To make the selected authentication scheme current, click Make Current Scheme.

   To learn more about an attribute, see field-level Help.

7. To save you changes, click Apply Changes.

Manage password policy for Application Express users (workspace administrators, developers, and end users) in all workspaces.

Password policies can:

• Apply to all users (including, Workspace administrators, developers, and end users) in an Oracle Application Express instance.

• Include restrictions on characters, password length, specific words, and differences in consecutive passwords.

• Apply to users signing in to Oracle Application Express Administration Services.

The Application Express instance administrator can select the password policy for service administrators. Options include:

• Use policy specified in Workspace Password Policy - Applies the password rules specified the in Workspace Password Policy.

• Use default strong password policy - Adds another layer of security to prevent hackers from determining an administrator's password. This password policy requires that service administrator passwords meet these restrictions:

  • Consist of at least six characters.

  • Contain at least one lowercase alphabetic character, one uppercase alphabetic character, one numeric digit, and one punctuation character.

  • Cannot include the username.

  • Cannot include the word Internal.

  • Cannot contain any words shown in the Must Not Contain Workspace Name field in this section.

  Password policies add another layer of security to prevent hackers from determining an administrator's password.

Manage password policy for Application Express users (workspace administrators, developers, and end users) in all workspaces.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Under Password Policy and specify the following attributes:

   Table 2-4 Workspace Password Policy Attributes

   Attribute	Description
   Password Hash Function	Select a hash function that Application Express uses to generate one way hash strings for workspace user passwords. To learn, see field-level Help.
   Minimum Password Length	Enter a number to set a minimum character length for passwords for workspace administrator, developer, and end user accounts.
   Minimum Password Differences	Enter the number of differences required between old and new passwords. The passwords are compared character by character, and each difference that occurs in any position counts toward the required minimum difference. This setting applies to accounts for workspace administrators, developers, and end users.
   Must Contain At Least One Alphabetic Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one alphabetic character as specified in the Alphabetic Characters field.
   Must Contain At Least One Numeric Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one Arabic numeric character (for example, 0,1,2,3,4,5,6,7,8,9).
   Must Contain At Least One Punctuation Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one punctuation character as specified in the Punctuation Characters field.
   Must Contain At Least One Upper Case Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one uppercase alphabetic character.
   Must Contain At Least One Lower Case Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one lowercase alphabetic character.
   Must Not Contain Username	Select Yes to prevent workspace administrator, developer, and end user account passwords from containing the username.
   Must Not Contain Workspace Name	Select Yes to prevent workspace administrator, developer, and end user account passwords from containing the workspace name, regardless of case.
   Must Not Contain	Enter words, separated by colons, that workspace administrator, developer, and end user account passwords must not contain. These words may not appear in the password in any combination of uppercase or lowercase. This feature improves security by preventing the creation of simple, easy-to-guess passwords based on words like hello, guest, welcome, and so on.
   Alphabetic Characters	Enter new or edit the existing alphabetic characters. This is the set of characters used in password validations involving alphabetic characters.
   Punctuation Characters	Enter new or edit existing punctuation characters. This set of characters must be used in password validations involving punctuation characters.

5. For Service Administrator Password Policy, select an option:
   • Use policy specified in Workspace Password Policy - Applies the password rules specified above in Workspace Password Policy to service administrator passwords.
   • Use default strong password policy - Requires that service administrator passwords meet these restrictions:

     • Consist of at least six characters

     • Contain at least one lowercase alphabetic character, one uppercase alphabetic character, one numeric digit, and one punctuation character

     • Cannot include the username

     • Cannot include the word Internal

     • Cannot contain any words shown in the Must Not Contain field specified above in Workspace Password P

6. Click Apply Changes.

You can restrict access to Oracle Application Express by DAD by creating a request validation function directive when you create the DAD.

mod_plsql and the embedded PL/SQL gateway support a directive which enables you to name a PL/SQL function which is called for each HTTP request. You can use this functionality to restrict the procedures that can be called through the embedded PL/SQL gateway or mod_plsql. The function returns TRUE if the named procedure in the current request is allowed and FALSE if it is not allowed. You can also use this function to enforce access restrictions for Oracle Application Express on a per-Database Access Descriptor (DAD) basis.

During installation, the installer also creates a PL/SQL function in the Oracle Application Express product schema (APEX_180100). To restrict access, you can change and recompile this function. The source code for this function is not wrapped and can be found in the Oracle Application Express product core directory in the file named wwv_flow_epg_include_local.sql.

Oracle Application Express ships with a request validation function named wwv_flow_epg_include_modules.authorize. This function specifies access restrictions appropriate for the standard DAD configured for Oracle Application Express.

The wwv_flow_epg_include_mod_local function is called by Oracle Application Express's request validation function which itself is called by the embedded PL/SQL gateway or mod_plsql. The Oracle Application Express function first evaluates the request and based on the procedure name, approves it, rejects it, or passes it to the local function, wwv_flow_epg_include_mod_local, which can evaluate the request using its own rules.

When you create new DADs for use with Oracle Application Express, the request validation function directive should be specified. Specifically, the function wwv_flow_epg_include_modules.authorize should be named in the directive PlsqlRequestValidationFunction in the Database Access Descriptor entry in dads.conf.

If you have no additional restrictions beyond those implemented in the wwv_flow_epg_include_modules.authorize function, there is no need to take any action with respect to the source code for the wwv_flow_epg_include_mod_local function.

You can change and recompile the wwv_flow_epg_include_local function to restrict access.

The source code for the wwv_flow_epg_include_local function is not wrapped and can be found in the Oracle Application Express product core directory in the file named wwv_flow_epg_include_local.sql. The source code is as follows:

CREATE OR REPLACE FUNCTION
wwv_flow_epg_include_mod_local(
    PROCEDURE_NAME IN VARCHAR2)
RETURN BOOLEAN
IS  
BEGIN  
    RETURN FALSE; -- remove this statement when  
you add procedure names to the "IN" list
    IF UPPER(procedure_name) IN (
          '') THEN  
        RETURN TRUE;  
    ELSE  
        RETURN FALSE;  
    END IF;  
END wwv_flow_epg_include_mod_local;
/

1. Remove or comment out the RETURN FALSE statement that immediately follows the BEGIN statement:

   ...
   BEGIN  
       RETURN FALSE; -- remove this statement when 
   you add procedure names to the "IN" list
   ...
   

2. Add names to the clause representing procedure names that should be allowed to be invoked in HTTP requests. For example to allow procedures PROC1 and PROC2 the IN list you would write IN ('PROC1', 'PROC2').

   After changing the source code of this function, alter the Oracle Application Express product schema (APEX_180100) and compile the function in that schema.

You can restrict access by altering the product schema.

1. Start SQL*Plus and connect to the database where Oracle Application Express is installed as SYS. For example:

   • On Windows:

     SYSTEM_DRIVE:\ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

   • On UNIX and Linux:

     $ sqlplus /nolog
     SQL> CONNECT SYS as SYSDBA
     Enter password: SYS_password
     

2. Alter the product schema (APEX_180100) by entering the following command:

   ALTER SESSION SET CURRENT_SCHEMA APEX_180100; 
   

3. Compile the function wwv_flow_epg_include_local.sql.

Define a list of authorized URLs.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Click the Authorized URLs tab.
5. Click Create Authorized URL.
6. In Authorized URL, identify an authorized URL that can be used as the parameter value to certain Application Express procedures, including APEX_UTIL.COUNT_CLICK. 

   The entire Authorized URL value will be compared with the URL parameter value in these procedures. If there is an exact match up to and including the entire length of the Authorized URL value, then the URL parameter value will be permitted.

7. Enter Create Authorized URL.

Edit a URL included in the list of authorized URLs.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Click the Authorized URLs tab.
5. Click the Edit icon adjacent to the URL.
6. Edit the Authorized URL and Description fields.
7. Click Apply Changes.

Delete a URL included in the list of authorized URLs.

1. Sign in to Oracle Application Express Administration Services.
2. Click Manage Instance.
3. Under Instance Settings, click Security.
4. Click the Authorized URLs tab.
5. Click the Edit icon adjacent to the URL.
6. Click Delete.
7. Click OK to confirm your selection.