Security restricted: Refusing to process UI page script without a valid CSRF token.

[Andrew Parkes]

Hi All,

I am received a warning in syslog_transaction.do when processing a UI Page script 

Security restricted: Refusing to process UI page script without a valid CSRF token.

 I have tried temporarily disabling the glide.security.use_csrf_token property but without any joy.

Has anyone encountering this and knows of a solution?

Thanks!

[SKB2]

Hello. I just got the same warning. Did you ever find a solution?

[Ramesh Lohar]

This issue is related to the Cross-Site Request Forgery (CSRF) token. ServiceNow uses CSRF tokens to prevent CSRF attacks by malicious web sites. The CSRF token is a random value associated with a user's session, which is used to verify that any request to modify data is made by the user, not a malicious third party.

Here are some steps you can take to resolve this issue:

1. Check the 'glide.security.use_csrf_token' system property:
- Navigate to sys_properties.list in the filter navigator.
- Search for the 'glide.security.use_csrf_token' property.
- If the property is set to true, ServiceNow will use CSRF tokens. If it's false, ServiceNow will not use CSRF tokens.

2. If the 'glide.security.use_csrf_token' property is set to true, you can try disabling it temporarily to see if that resolves the issue. However, this should only be done in a non-production environment as it can expose your instance to CSRF attacks.

3. If disabling the 'glide.security.use_csrf_token' property doesn't resolve the issue, you may need to review your UI Page script. Make sure that any form submissions or AJAX requests include the CSRF token. You can get the CSRF token using the 'g_scratchpad' object in client scripts or the 'GlideSystem' object in server scripts.

4. If you're still encountering the issue, it may be due to a bug or issue with your specific ServiceNow version. In this case, you should contact ServiceNow Customer Support for further assistance.

Remember, it's important to re-enable the 'glide.security.use_csrf_token' property once you've finished troubleshooting to ensure your instance is protected against CSRF attacks.

nowKB.com