Oracle HTTP/Apache vs XML DB, or pl/sql gateway vs embedded pl/sql gateway

Hello,

I've been looking for information about how to secure Oracle's embedded pl/sql gateway or even to understand how exactly it works. I found a lot on the pl/sql gateway available through Oracle HTTP server
(mod_plsql) but very little about the XML DB.

I found some information about how to configure basic embedded pl/sql DAD and I came across the exclusion list api, which looks and sounds a lot like Oracle's fix for the problems with the Oracle HTTP pl/sql gateway since alert #68. I understand that problem is fixed in the latest patch release April2006 but I still can't find much information about XML DB.

Can someone point me at a technical document which describes how embedded pl/sql gateway is different than the HTTP pl/sql gateway?
( I know on the surface there is no HTTP server running for XML DB but
the URL still access a port directly on the server apparently with some sort of interaction with the listener and that's the information I'm really interested in.) Where are the actions using the embedded pl/sql gateway logged? Are they logged to the listener log?

Thanks very much!

Mike Vavrus

--
http://www.freelists.org/webpage/oracle-l