Idea Summary
We would like Oracle APEX to provide a supported package, procedure, or API that allows an application to forcefully terminate an authenticated APEX user session.

The required behavior should be equivalent to an expired APEX session: once the session is terminated, any subsequent request using that session must be treated as unauthenticated and the user must be required to log in again.

The requirement is to invalidate the actual authenticated session, not merely clear application items, session state, cookies, or other application-level data.

We have evaluated the existing APEX_SESSION.DELETE_SESSION procedure for this purpose. Based on our testing, it does not provide the expected behavior: after the procedure is executed, an already authenticated browser session can continue accessing the application instead of being forced through the login process.

Therefore, we believe the behavior and purpose of APEX_SESSION.DELETE_SESSION should be reviewed and clarified.

Use Case
An application administrator needs to immediately terminate an active user's session. This may be required when:

• The user's roles or privileges have changed.
• The user's account has been disabled.
• A security incident or potentially compromised session has been detected.
• Authorization changes require the user to authenticate again.
• An administrator needs to revoke a user's active session.

The administrator selects the user's active APEX session and chooses an action such as "Terminate Session".

After the session is terminated, the next request from that browser must be rejected as an authenticated request and the user must be redirected to the application's login page, requiring a new authentication.

**Preferred Solution (Optional)**Please review the current behavior of APEX_SESSION.DELETE_SESSION and provide an officially supported mechanism for forcefully terminating an authenticated APEX user session.

The required API should:

1. Allow an application to invalidate the current APEX session.
2. Allow, where appropriately authorized, an application administrator to invalidate a specific user's APEX session by session ID.
3. Completely invalidate the server-side authentication/session context.
4. Cause subsequent requests using the terminated session to be treated as unauthenticated.
5. Redirect the user to the application's login page or otherwise require a new authentication process.
6. Produce behavior equivalent to an expired or otherwise invalidated APEX authentication session.
7. Be safe for use in production applications.
8. Be officially supported and documented by Oracle APEX.
9. Avoid requiring applications to access or modify internal APEX tables or undocumented implementation details.

In particular, please review APEX_SESSION.DELETE_SESSION because, based on our testing, it does not currently achieve the expected result of forcing an already authenticated user to log in again.

Please clarify:

• What exactly APEX_SESSION.DELETE_SESSION is intended to invalidate.
• Whether it is expected to invalidate the user's authentication state in addition to the APEX session.
• Why a browser with an existing authenticated session can continue accessing the application after DELETE_SESSION is executed.
• Whether there is currently another officially supported API or procedure that provides true forced session termination.
• If no such API exists, please consider providing one as part of the supported Oracle APEX API.

The key requirement is not merely to delete session state; it is to force the existing authenticated user session to become invalid and require the user to authenticate again.