Security - Oracle APEX Best Practices - page 150

The following screenshot shows SSL at instance level (navigation path: APEX_ADMIN/
Manage Instance/Security ):
When you enable SSL at the administration website of APEX, you need to ensure
that the HTTPS protocol is enabled on your web server. Additional information
about security considerations in web servers can be found at http://docs.oracle.
com/cd/E14571_01/security.htm .
Security considerations when installing
Oracle Application Express
Even before installing Application Express, you need to think about security
measures to be taken during each step of the installation process.
Runtime installation
An Oracle Application Express runtime environment enables you to run production
applications, but it does not provide a Web interface for administration or direct
development of these applications. So, this makes it more an indurate environment.
The runtime environment is a more secure environment, because only the necessary
objects and privileges are installed and conigured.
You administer the Oracle Application Express runtime environment using
SQL*Plus or SQL Developer and the APEX_INSTANCE_ADMIN API. The ADMIN account
is not used in a runtime environment, but is created anyway. It will be used if the
runtime environment is converted to a full development environment.
To determine if only the runtime environment is installed, connect as SYS and run
the following query (Oracle Application Express version 4.x):
Select count(*) from APPLICATION_EXPRESS_040200.WWV_FLOWS where id =
4000;
The query checks if the runtime is installed. The ID is always equal to 4000 , so do not
enter your application ID. If the count is 0 , it is a runtime; if the count is 1 , it is a full
development environment.