About Application Sessions

An application session contains information relevant to the application and its user. An application session stores application session state as a collection of attribute-value pairs. These attribute value pairs are divided into namespaces. Unlike traditional heavyweight database sessions, an application session does not hold its own database resources, such as transactions and cursors. Because application sessions consume far fewer server resources than heavyweight sessions, an application session can be dedicated to each end application user. An application session can persist in the database and resume later with minimal cost.

To configure an application session, you work in two phases:

1. You create and maintain the application session.

2. You can manipulate the session state during the life of the session.

You can use either PL/SQL APIs or Java APIs to configure application sessions. This chapter describes the programmatic creation, use, and maintenance of application sessions in PL/SQL, and includes specific links to comparable Java information.

See Also:

• Oracle Database Real Application Security SQL Functions and Oracle Database Real Application Security PL/SQL Packages for information about PL/SQL API syntax

• Oracle AI Database Real Application Security Java API Reference for information about Java API syntax (in Javadoc format)

• Using Real Application Security in Java Applications for information about performing tasks with Java APIs

This section contains:

• About Application Sessions in Real Application Security

• Advantages of Application Sessions

About Application Sessions in Real Application Security

Real Application Security Architecture shows a Real Application Security architecture diagram and indicates how application sessions fit into it. The figure shows applications creating application sessions in the database. Some of these application sessions are associated with traditional database (DB) sessions.

Real Application Security Architecture also shows other components of Real Application Security such as ACLs, application privileges, application users, and application roles.

Real Application Security Architecture

Description of the illustration fs_arch.png

Advantages of Application Sessions

Application sessions have functional advantages over traditional database sessions. For example, traditional database sessions are typically unaware of the end user identities or the security policies for those end users. On the contrary:

• Application sessions encapsulate end user’s security context. They enable applications to use database authorization mechanisms for access control based on the end user identity.

• An application session can be associated with multiple database sessions simultaneously.

• They are accessible by all nodes in an Oracle Real Application Clusters (Oracle RAC) environment.

Application sessions have these performance advantages over traditional database sessions:

• They can be created with less overhead than traditional database sessions.

• They can persist in the database and resume later with minimal cost.

• Real Application Security can collect session attribute changes and session states on the client, using caches. Then, these changes are appended to the database until the next database roundtrip, reducing the number of database roundtrips.