How to find if an Oracle APEX session is expired

Question

Short version:

If the function wwv_flow_custom_auth_std.is_session_valid (or apex_custom_auth_std.is_session_valid) returns TRUE, is it possible that the session is expired but still alive? If so, how can you check if a session is expired?

Long version:

I have created a single-sign-on system for our Oracle APEX applications, roughly based on this tutorial:

http://www.oracle.com/technology/oramag/oracle/09-may/o39security.html

The only difference is that my master SSO login is in Perl, rather than another APEX app. It sets an SSO cookie, and the app can check if it's valid with a database procedure.

I have noticed that when I arrive in the morning, the whole system doesn't work. I reload a page from the APEX app, it then sends me to the SSO page because the session was expired, I logon, and get redirected back to my original APEX app page. This usually works except first thing in the morning. It seems the APEX session is expired. In that case it seems to find the session, but then refuse to use it, and sends me back to the login page.

I've tried my best to trace the problem. The "wwv_flow_custom_auth_std.is_session_valid" function returns true, so I'm assuming the session is valid. But nothing works until I remove the APEX session cookie. Then I can log back in easily.

Anybody knows if there is another call that would tell me if the session is expired or not?

Thanks

Answer 1

You can set the Maximum Session length in seconds under the application security attributes page.

Apex states the following:

"The session duration may be superseded by the operation of the job that runs every eight hours which deletes sessions older than 12 hours."

You could use the view apex_040100.APEX_WORKSPACE_SESSIONS to determine if a session is valid based on its existance or creation time. eg: session_created - systdate > 12Hours.

You should also use the "On session timeout direct to this URL" attribute.

Answer 2

This solution would require privileged access but you can query the wwv_flow_sessions$ view in your apex schema for any session that matches your username. If none exists, your session has timed out. This view also gives you a field 'idle_timeout_on' that will tell when your session is scheduled to time out.