Introduction:
This document explains the implementation of Multiple Session Restriction in Oracle APEX applications.
The objective of this solution is to ensure that a single user cannot maintain multiple active sessions at the same time across different browsers, devices, or tabs.
Why We Need to Do This?
Restricting multiple sessions per user is a crucial requirement for maintaining both security and control within an Oracle APEX application.
Allowing the same user account to be logged in from multiple devices or browsers simultaneously can lead to risks such as credential sharing, data misuse, and difficulty in tracking true user activity.
How Do We Solve It?
STEP 1: In APEX Application
Go to Page 0 and Create Page Item (P0_ACTIVE_SESSION).
STEP 2: Create Dynamic Action,
Event :On Page Load
Name : Find active session
Items to Return : P0_ACTIVE_SESSION
Client-Side Condition : Item is null (P0_ACTIVE_SESSION)
Server-Side Condition : Current page != Page
Value : 9999
TRUE ACTION 1 :
Plsql Code:-
Declare
lv_count number;
BEGIN
pkg_apex_login_audit.Sp_user_session_audit;
SELECT count (*) into lv_count
FROM apex_workspace_sessions
where APEX_SESSION_ID <> :SESSION_ID and USER_NAME = :APP_USER;
IF lv_count > 0
THEN
:P0_ACTIVE_SESSION :=’Y’;
ELSE
:P0_ACTIVE_SESSION :=’N’;
END IF;
END;
TRUE ACTION 2 :
Execute Javascript code:-
if ($v(‘P0_ACTIVE_SESSION’) == ‘Y’) {
apex.message.confirm(‘Already Active Session found you want to continue?’, function(okPressed) {
if (okPressed) {
$.event.trigger(‘KillOldSession’);
}
else {
$.event.trigger(‘KillCurrentSession’);
} }); }
Step 3: Create Dynamic Action,
Event :Custom
Name : Kill Old session
Custom Event : KillOldSession
Selection Type : Javascript Expression
JavaScript Expression : document
TRUE ACTION 1 :
Plsql Code:-
DECLARE
lv_count NUMBER;
BEGIN
FOR i IN (
SELECT apex_session_id
FROM apex_workspace_sessions
WHERE apex_session_id <> :APP_SESSION
AND user_name = :APP_USER )
LOOP
— Terminate the old session
apex_session.delete_session(
p_session_id => i.apex_session_id );
END LOOP;
END;
Step 4: Create Dynamic Action,
Event :Custom
Name : Kill Current session
Custom Event : KillCurrentSession
Selection Type : Javascript Expression
JavaScript Expression : document
TRUE ACTION 1 :
Plsql Code:-
apex_util.redirect_url ( p_url => ‘login?session=’|| :APP_SESSION || ‘9999’);
Conclusion:
Overall, restricting multiple sessions not only protects sensitive data but also optimizes performance and supports organizational governance policies, making it a key best practice in managing APEX applications.
Output:
Session 1
Session 2
On Click of Cancel: Kills Current session
