---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\]

# Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\] {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Configure the
glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled
property to the secure value to prevent users from continuing to use a session via cookies
after the OAuth token used to create the session expires.
When the
glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled
property is not set to the secure value of true, a user may continue to use a
session via cookies after the OAuth token used to create the session expires. This
increases the risk of cookies being leaked and the session being hijacked by a
malicious user to access unauthorized resources. Ensure that the
glide property
glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled
is set to true. If the record does not exist in the sys_properties table, the
default value is false.

## More information {#sc_invalidate_session_after_oauth_token_expiration__section_qhx_1b1_xwb}

{#sc_invalidate_session_after_oauth_token_expiration__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | For zboot instances, the property is true. For the update instances, the property is false by default. |
| Category | [Session management](https://www.servicenow.com/docs/_PKuTiHpBk7wT4~Tu0SZXA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 5.4 * CVSS score: Medium * Security risk details: When this property is not set to the secure value of true, a user may continue to use a session even after the OAuth token used to create the session has expired, increasing the likelihood of the session being hijacked by a malicious user. {#sc_invalidate_session_after_oauth_token_expiration__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | True: Cookie authentication is only honored until the OAuth access token expires; after the expiration, authentication is not honored. False: Cookie authentication is honored even after the OAuth access token expires. |
[ ]

{#sc_invalidate_session_after_oauth_token_expiration__table_ajc_b43_3kb}