Do we need do use glide.security.url.whitelist property

[Gemma4]

Hi Everyone, 

While working on instance security center to improve our compliance score, one of our high recommendations is the glide.security.url.whitelist" property.

Do we need do use "glide.security.url.whitelist" property and if so what should the values be? 

Has anyone experience issues aftewards reported in the following kb https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0831476

Thanks so much for all your feedback

Gemma

[Gemma4 · Accepted solution]

Got it so in the prod instance the preserver would be set like the attached, correct, so it wouldn't overwrite what is in each instance? 

[Karan Chhabra6]

Hi @Gemma4 ,

Security is compromised when a vulnerable web page is redirected to a malicious page, this property helps to implement a safe redirection during login,logout or other redirections.

The property value should be a Fully Qualified Domain Name(s), example: https://www.servicenow.com

If you have external authentication in place, this propery value should not be left blank, it should contain the Identity Provider's host name - if left blank, the login requests may generate an infinite loop between servicenow and the identity provider.

If my answer has helped with your question, please mark it as correct and accepted solution.

Thanks,

Karan

[Gemma4]

Hi @Karan Chhabra6 

Thank you so much for the feedback, that is very helpful. Just to clarify, our users use the following address to reach ServiceNow https://companyname.service-now.com/navpage.do so is the following the correct property value https://companyname.service-now.com

Also, how did you verify testing for this, just curious if you performed any unique test cases? 

Thanks

Gemma

[Karan Chhabra6]

@Gemma4 , yes the value is correct
I'm not sure on the testing part, need to check

If my answer has helped with your question, please mark it as helpul and accepted solution.

Thanks!

[Gemma4]

Thank you, I suppose I can test out functionality in my pdi before going forward with this. Did you configure any of your clone settings so this setting isn't wiped out from a clone? For example a clone from prod to dev should not copy the prod url to dev since the url's will be different. Last question, I promise 😀