Security - Oracle APEX Best Practices - page 180

Item encryption
In version 3.2.1 from Oracle Application Express and higher, it is possible to store
data encrypted in session state. Item security is a property of an item.
The following screenshot shows the item security property named Store value
encrypted in session state :
Hidden items protection
Oracle Application Express has two types of hidden items:
• Hidden : A form element that is not visible within the HTML page
• Hidden and protected : A form element, but the value is checked by the
server to ensure the value has not been modiied
The following screenshot shows a hidden and protected item:
It is safer to use a value that is Hidden and Protected, by default, for maximum
security. The reason is that a hidden item will very probably not change and this
will protect against unwanted change of the value by a client-side script.
The Oracle Application Express User's Guide states:
"For maximum security, use Hidden and Protected instead
of Hidden unless your page has client-side behavior; for
example, JavaScript that alters the item value after the page
is rendered by Oracle Application Express."