Application Session Concepts Used in Application Security

Real Application Security introduces the concept of an application session. Within the context of application sessions, there are three types of user identities:

• Application session user: The user associated with the application session.

  Application session access to database objects is checked against the permissions granted to this user.

• Traditional (heavyweight) session user: The user that established the database session.

  This user can be an application user or a database user, as long as database authentication credentials are available.

• Schema owner: The database schema is the schema associated with the traditional database session and is only used for object name resolution.

Traditional database user sessions have these characteristics:

• They hold their own database resources, such as transactions and cursors.

• They consume many server resources.

Application sessions have these characteristics:

• They contain information that is pertinent only to the application.

• They can be dedicated to each end application user.

• They can persist until the application user logs out of the application or the application terminates unexpectedly.

See Configuring Application Sessions for more information about application sessions.