About Items of Type Password

Password items do not emit the text entered to the web browser screen. When creating password items, Oracle recommends using password attributes that do not save session state to prevent the password from being saved in the database in the session state tables.

Configurable password item type attributes include:

• Settings, Submit when Enter pressed - If set to On, the page is submitted when the user presses ENTER.

• Appearance, Template Options, Common, Hide Password Visibility - By default, the password field has a Show Password button that users can click to show their password. If you select Hide Password Visibility, the Show Password button is disabled.

• Validation, Value Required - If set to On and the page item is visible, Oracle APEX automatically performs a NOT NULL validation when the page is submitted. If set to Off, a NULL value is accepted.

• Session State, Storage - If set to Per Request (Memory Only), the value is not written to the database and is only available for the current request. For highly sensitive values, this is the preferred setting.

  Caution: If you set Storage to Per Session (Persistent), be sure to set Store value encrypted in session state to Yes.

• Security, Authorization Scheme - Optionally select an authorization scheme which must evaluate to TRUE in order for this component to be rendered or otherwise processed.

• Security, Session State Protection - Select the level of session state protection:

  • Unrestricted - The item can be set by passing the item in a URL or in a form. No checksum is required in the URL.

  • Checksum Required - Application Level - The item can be set by passing the item in a URL that includes a checksum specific to the workspace and application.

  • Checksum Required - User Level - The item can be set by passing the item in a URL that includes a checksum specific to the workspace, application, and user.

  • Checksum Required - Session Level - The item can be set by passing the item in a URL that includes a checksum specific to the session.

  • Restricted - May not be set from browser - The item can not be altered using the URL or POSTDATA. Select this option to restrict what can set the item value to internal processes, computations, and so on. This attribute only applies to items that are not used as data entry items and is always observed, even if Session State Protection is disabled.

• Security, Store value encrypted in session state - To encrypt an item when stored in session state, set this attribute to On. To learn more, see About Session State and Security.