Skip to Main Content
Feature Request FR-4930
Product Area Security
Status OPEN

1 Voters

Public API for Setting Sticky Cookies During APEX Authentication and AJAX-Based Submits

rode.mb Public · Jun 18 2026

Currently, Oracle APEX provides APEX_AUTHENTICATION.SEND_LOGIN_USERNAME_COOKIE, which reliably persists cookies during the login process, even when the login page uses modern submit handling.

However, there is no equivalent public API for setting custom application cookies.

Developers who need to set their own cookies during authentication or page submit processes are forced to use OWA_COOKIE.SEND or manually emit Set-Cookie headers. These approaches do not always work reliably in APEX-managed request/response flows, especially when using AJAX-based submit processing (for example, when "Reload on Submit" is not set to "Always").

Internally, APEX already provides a mechanism to reliably persist cookies during authentication, but this functionality is not exposed through a supported public API for custom application cookies.

Suggested Enhancement

Provide a supported public API such as:

APEX_AUTHENTICATION.SET_COOKIE(
    p_name       => 'MY_COOKIE',
    p_value      => 'VALUE',
    p_path       => '/',
    p_domain     => null,
    p_expires    => sysdate + 30,
    p_samesite   => 'Lax',
    p_secure     => true,
    p_httponly   => true );

or alternatively:

APEX_UTIL.SET_COOKIE(...)

The API should:

  • Work reliably during authentication processing.
  • Work reliably during AJAX-based submits.
  • Support modern cookie attributes (SameSite, Secure, HttpOnly, Path, Domain, Max-Age).
  • Integrate with APEX's internal response handling.
  • Eliminate the need for unsupported internal APIs or custom workarounds.

Current Workaround

The current workaround is to either:

  • Set Reload on Submit = Always, forcing a full page reload so that standard OWA_COOKIE.SEND processing works reliably, or
  • Defer cookie creation to a later rendering phase (for example, a Before Header / Pre-Rendering process on the target page).

While these approaches work, they introduce implementation constraints that are unrelated to the business requirement of setting a cookie.

Business Value

Many applications need to maintain additional browser state during login and session initialization, such as:

  • User preferences
  • Application-specific identifiers
  • Feature flags
  • Multi-application integration scenarios
  • SSO-related metadata

A supported cookie API would provide a reliable and future-proof solution while reducing the need for custom implementations and undocumented workarounds.

Expected Benefit

Developers should be able to set custom cookies with the same reliability as APEX-managed cookies, regardless of whether the request is processed through a full page submit, an authentication flow, or an AJAX-based submit.

This idea is open.