| How to set Apache environment variables from Forms [message #573207] |
Mon, 24 December 2012 02:45 |
 |
dxbrocky
Messages: 1
Registered: April 2012
|
Junior Member |
|
|
Hi,
We have an application, where we invoke a URL pointing to a folder on the Application Server, so that users can download files from the same.
There is user authentication provided for the URL.
Example :
Our application ABC (example) which is built with Oracle Forms 10g, hosted on Application server (itxxx123) inovkes a module GEN9999 which on pressing a button calls a URL which is open in the Internet Explorer browser.
If the URL has been called from the Forms or the Application (ABC), then it should be allowed.
If the URL is called standalone, by Opening IE Browser and invoking the URL, this should not be allowed.
However, there have been security concerns raised during Audit, saying that users can access the
URL directly from the Browser instead of the Application. Also the URL is saved the Browser history, so even if the user is no longer working in the Application Team, and has moved out of the team, then the ex-user can still access the URL and view and download files.
Is there any way to restrict access to the URL such that is only accessible when it is called from the Application, and that access is restricted when directly called from the Browser.
I have seen that environment variables in httpd.conf may be usable for the above. However, not sure how to use them from Oracle Forms.
Kindly suggest the way forward.
Thanking you
|
|
|
|
] 
Blog
Search
Help
Members
Register
Login
Home
