---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Exploring High Security Settings

# Exploring High Security Settings {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read

High Security Settings refer to several security options available in your instance.{#exploring-high-security-settings__high-sec-desc}

The High Security Settings module is activated with the High Security Settings plugin, which is active by default on new instances. If High Security Settings are not active on your instance, see [Requesting High Security Settings activation](https://www.servicenow.com/docs/irHhQALhlH9MlwFSJo~gSg "The High Security Settings plugin is active by default on all new instances. If it is not active on your instance, you can request the plugin."). To learn more about this plugin, see [Enable High Security Plugin \[Updated in Security Center 1.3\]](kLPspnnvGCOpP55iAMqRPw "When you activate the High Security plugin, it creates or updates hundreds of different configurations to control the level of security on your instance. These configurations mitigate many of the top OWASP attacks by enabling strict access control, input validation, and output encoding.") in Instance Security Hardening Settings. Properties for these types of high security settings are available:

* Default property values: To harden security on your platform by centralizing all critical security settings to one location for management and auditing.
* Default deny property: Provides a security manager property to control the default security behavior for table access.
* Security Administrator role: Provides a role to prevent modification of key security settings and resources. The Security Administrator role is not inherited by the admin role and must be explicitly assigned.
* Elevated privileges: Allows users with the security admin role to operate in the context of a normal user and elevate to higher security role when needed.
* Property access controls: Allows security administrators to set the roles required to read and write properties.
* System logs: Are read only.
* Access control rules: Control what data users can access and how they can access it.

{#exploring-high-security-settings__ul_ukr_wdf_zq}  
Note:  
* High Security Settings also automatically activates the Contextual Security plugin, if it is not already active. In addition, Platform Security Settings - High delivers settings and features in the context of increasing the security of your instance.
* The Instance Security Hardening Settings content contains detailed descriptions, and compliance values, for the security-related system properties and plugins in the ServiceNow AI Platform.
* To learn more about each of these properties, see [Hardening settings](https://www.servicenow.com/docs/ij03GqkYdPjF42daKxhB2g "The ServiceNow Security Center (SSC) hardening settings content contains detailed descriptions and compliance values for the security-related system properties and plugins in the ServiceNow AI Platform. You can set these properties using the hardening settings app in the Security Center.").
{#exploring-high-security-settings__ul_hbl_whk_nsb}  
There are two ways to set or change High Security Settings properties.

* Navigate to System SecurityHigh Security Settings.

  Options on the High Security Properties page are Yes or No.
* Navigate to the sys_properties.list and search for the property you want to set or change.

  Options in the System Properties table \[sys_properties.list\] are true or
  false.
{#exploring-high-security-settings__ul_uck_d3j_tbb}

## Property access control {#exploring-high-security-settings__section_zpq_gsn_ryb}

Two additional columns are created in the Properties \[sys_properties\] table when High Security Settings are active:

* read_roles: A comma-separated list of role names that are allowed to read all fields of this property.
* write_roles: A comma-separated list of role names that are allowed to write/modify all fields of this property.

{#exploring-high-security-settings__ul_xys_hkf_zq}

Properties listed in the Properties table have read_roles of admin, and write_roles of security_admin. Users with the admin role can view and read the property values, but must elevate to
the security_admin role to modify them.

## Notifications {#exploring-high-security-settings__section_aqq_gsn_ryb}

Activation of high security settings also activates security warning messages. The following is an example of a message that appears after an approval.  
Figure 1. Security Warning notification

## High Security Settings properties {#exploring-high-security-settings__section_oql_pbz_k1b}

{#exploring-high-security-settings__table_q1z_23k_nsb__entry__4}

| Property | Description | Default Value | Instance Security Hardening Settings |
|-|-|-|-|
| glide.ui.escape_text | Escape XML values at the parser level for the user interface. Prevents reflected and stored cross-site scripting attacks. This property is not applicable in Service Portal. Note: This property is set to true by default in Vancouver and later releases, and can't be changed by administrators. For a use case where the property has to be changed, contact customer support. | Yes | [Escape XML markup \[Updated in Security Center 1.3\]](g~D8JyEegHVvpSVtRbvh8w "Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client's browser.") |
| glide.ui.escape_all_script | Forces all expressions within Jelly JavaScript `<script type="text/javascript">` tags to be escaped by default. Enforces escaping only if the type attribute in the `<script>` tag is empty, or if the value is `text/javascript`, `text/ecmascript`, `application/javascript`, `application/ecmascript`, or `application/x-javascript`. | Yes in new instances | [Escape jelly script \[Updated in Security Center 1.3 and 1.5\]](nFAJCmYht6xaJ1Qh3pTDFg "Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.") |
| glide.ui.rotate_sessions | Rotate HTTP session identifiers to reduce security vulnerabilities. See: <http://www.owasp.org/index.php/Session_Management#Rotate_Session_Identifiers>. | Yes Note: If you are using the SAML 2.0 plugin for Single Sign-on authentication, set this property to No. Otherwise, it interferes with the session information sharing that takes place between the instance and the Identity Provider. | [Rotate HTTP session identifiers](https://www.servicenow.com/docs/YIgc~dmmkObsPIF8UmNx~Q "Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities.") |
| glide.ui.secure_cookies | Enable secure session cookies: Enable additional cookie security. If Yes, strict session cookie validation is enforced. | Yes | [Enforce strict security of session cookies \[Updated in Security Center 1.3\]](jUdruX3i2RJCn2lLAsVZKQ "Use the glide.ui.secure_cookies property to require properly formatted cookies") |
| glide.security.password_reset.uri | For mobile Password Reset, URL that the user is taken to when the user clicks the Forgot password? button. |   | None |
| glide.security.strict.updates | Double-check security on inbound transactions during form submission (rights are always checked on form generation). Note: This property is set to true by default in Vancouver and later releases, and can't be changed by administrators. For a use case where the property has to be changed, contact customer support. | Yes | [Double check inbound transactions \[Updated in Security Center 1.3\]](L4b_MC29yadA12Ds2M12mg "Use the glide.security.strict.updates property to enable double-checking of security on inbound transactions during form submission. When you set this property to true, it adds an extra layer of table validation before a form renders in the browser.") |
| glide.security.strict.actions | Check conditions on UI actions before execution. Normally conditions are checked only during form rendering. | Yes | [Check UI action conditions before execution](https://www.servicenow.com/docs/j2NrIQI9iFvQDdVCIFGrqg "Use the glide.security.strict.actions property to enable checking of UI actions conditions in forms and lists before they execute. When you set this property to true, it adds an extra layer of validation on the table UI actions before they are executed.") |
| glide.security.use_csrf_token | Enable usage of a secure token to identify and validate incoming requests. This token is used to prevent cross-site request forgery attacks. | Yes | [Enable Anti-CSRF token \[New in Security Center 1.3, updated in 1.5, and removed in 2.0\]](3QD5uzqS5knA0V5cDZBBiw "Use the glide.security.use_csrf_token property to ensure the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.") |
| glide.ui.escape_html_list_field | Escape HTML for HTML fields in a list view. | Yes | [Escape HTML in list views \[Updated in Security Center 1.3 and 1.5\]](IJXKfQ6rPuk0UV1DBw~MDA "Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view.") |
| glide.html.escape_script | Escape JavaScript tags in HTML fields. | Yes | [Escape JavaScript \[Updated in Security Center 1.3\]](lYRUaodARv0b55onN3t7Pg "Use the glide.html.escape_script property to force escape from JavaScript (<script></script>) tags in HTML fields during list views.") |
| glide.ui.forgetme | Remove the Remember me check box from the login page. | Yes | [Remove remember me](https://www.servicenow.com/docs/qJtCQgUgQeroqJl_wYN47A "Use the glide.ui.forgetme property to remove the Remember Me check box from the login page to prevent login information from being cached.") |
| glide.smtp.auth | Authenticate with the SMTP server by the user name and password properties. Note: This property is deprecated. | Yes |   |
| glide.soap.strict_security | Enforce strict security on incoming SOAP requests. Requires incoming SOAP requests to go through the security manager for table and field access and checks SOAP users for the correct roles for using the web service. | Yes | [Enforce SOAP request strict security \[Updated in Security Center 1.3\]](9jluK8xAsyoAcpipqBfrwg "Use the glide.soap.strict_security property to enforces web service security.") |
| glide.basicauth.required.wsdl | Require authorization for incoming WSDL requests. Note: If you choose not to require authorization for incoming WSDL requests, you must modify the Access Control (ACL) rules to allow guest users to access the WSDL content. | Yes | [Require authorization for WSDL request \[Updated in Security Center 1.3 and 1.5\]](ngJtCz68gvNF~sbFfuGCNg "Use the glide.basicauth.required.wsdl property to designate if incoming WSDL (Web Services Description Language) requests should require basic authentication.") |
| glide.basicauth.required.csv | Require basic authorization for incoming CSV requests . | Yes | [Require authorization for csv requests \[Updated in Security Center 1.3\]](tokZudbbySt1zOEPX0~MJw "Use the glide.basicauth.required.csv property to designate if incoming CSV (Comma-Separated Values) requests should require basic authentication.") |
| glide.basicauth.required.excel | Require basic authorization for incoming Excel requests. | Yes | [Require authorization for excel requests \[Updated in Security Center 1.3\]](TgVi2yS~RRXr9~bbYG6wzw "Use the glide.basicauth.required.excel property to designate if incoming Excel requests should require basic authentication.") |
| glide.basicauth.required.importprocessor | Require basic authorization for incoming import requests. | Yes | [Require authorization for import requests \[Updated in Security Center 1.3\]](P~wUJGr6cuB6Zub~70UkgA "Use the glide.basicauth.required.importprocessor property to designate if incoming import requests should require basic authentication.") |
| glide.basicauth.required.pdf | Require basic authorization for incoming PDF requests. | Yes | [Require authorization for pdf requests \[Updated in Security Center 1.3\]](z09qQhO1_OJnHyxu2pP50A "Use the glide.basicauth.required.pdf property to designate if incoming PDF requests should require basic authentication.") |
| glide.basicauth.required.rss | Require basic authorization for incoming RSS requests. | Yes | [Require authorization for RSS requests \[Updated in Security Center 1.3\]](_XXLM1BoAsJ4fnw9OH2wSg "Use the glide.basicauth.required.rss property to designate if incoming RSS requests should require basic authentication.") |
| glide.basicauth.required.scriptedprocessor | Require basic authorization for incoming script requests. | Yes | [Require authorization for script requests \[Updated in Security Center 1.3\]](AIoJ7duxXtMiDcPcKWr0lw "Use the glide.basicauth.required.scriptedprocessor property to designate if incoming script requests should require basic authentication.") |
| glide.basicauth.required.soap | Require basic authorization for incoming SOAP requests. | Yes | [Require authorization for SOAP requests \[Updated in Security Center 1.3, 1.5, and 2.0\]](v4y7p6FPVBU1~AtU2WWSpg "Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.") |
| glide.basicauth.required.unl | Require basic authorization for incoming unload requests. | Yes | [Require authorization for unload requests \[Updated in Security Center 1.3\]](Xde8WVewJesUEZezFcdFZA "Use the glide.basicauth.required.unl (useUnloadFormat) property to designate if incoming unload requests should require basic authentication.") |
| glide.basicauth.required.xml | Require basic authorization for incoming XML requests. | Yes | [Require authorization for XML requests \[Updated in Security Center 1.3\]](1KEJDyfGlHCTciO6QZczPA "Use the glide.basicauth.required.xml property to designate if incoming XML requests should require basic authentication.") |
| glide.basicauth.required.xsd | Require basic authorization for incoming XSD requests. | Yes | [Require Authorization for XSD Requests \[Updated in Security Center 1.3\]](8foe30O78A208hsIBqNgLA "Use the glide.basicauth.required.xsd property to designate if incoming XSD (XML Schema Definition) requests should require basic authentication.") |
| glide.cms.catalog_uri_relative | Enforce relative links from the URI parameter on /ess/catalog.do. If Yes, only relative URLs are permitted through the /ess/catalog.do page using the uri parameter. If No, all URLs are permitted, which may permit linking to external unauthorized content. | Yes | [Enforce relative links \[Updated in Security Center 1.3 and 1.5\]](BbESQ34gS_MiQy7XfJA2rQ "Use the glide.cms.catalog_uri_relative property to enforce relative links from the URI parameter on /ess/catalog.do.") |
| glide.set_x_frame_options | Enable this property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages. The X-Frame-Options HTTP response header can be used to indicate whether a browser should be allowed to render a page in a \<frame\> or \<iframe\>. Sites can use this property to avoid clickjacking attacks by ensuring that their content is not embedded into other sites. <https://developer.mozilla.org/en/the_x-frame-options_response_header> | Yes | [Implement the x-frame-options: SAMEORIGIN security header \[Updated in Security Center 1.3\]](~uWQo1h8h4PoXKCPJ8PYhg "Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.") |
| glide.ui.attachment.download_mime_types | A list of comma-separated attachment mime types that do not render inline in the browser. Prevents cross-site scripting attacks. For example, <kbd class="ph userinput">text/html</kbd> forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. | <kbd class="ph userinput">text/html,image/svg,image/svg+xml</kbd> | [Restrict downloadable MIME types \[Updated in Security Center 1.3 and 2.0\]](LJJkDpPXO6FAqch_LcxKRA "The glide.ui.attachment.download_mime_types property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.") |
| glide.security.groupby_acl_check | When this property is enabled, ACL checks for GroupBy operations are performed for the group names based on the actual data from the groups. | Yes | None |
| glide.security.diag_txns_acl | If Yes, only the admin user or user from allowed IP address can access <kbd class="ph userinput">stats.do</kbd>, <kbd class="ph userinput">threads.do</kbd>, and <kbd class="ph userinput">replication.do</kbd>. | No | [Restrict performance monitoring access \[Updated in Security Center 1.3\]](mmwJVQZcS6zXv9YUi4v5gg "Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.") |
| glide.ui.security.codetag.allow_script | Allow embedded HTML (using \[code\] tags) to contain JavaScript tags. Note: This property is set to true by default in Vancouver and later releases, and can't be changed by administrators. For a use case where the property has to be changed, contact customer support. | No | [Disable embedded HTML code \[Updated in Security Center 1.3\]](hC485Kg5nkm8LTyn6OmuiA "Use the glide.ui.security.allow_codetag property to disable support for embedding HTML code created using the [code] tag.") |
| glide.script.allow.ajaxevaluate | Enable the AJAXEvaluate processor. The AJAXEvaluate API call allows the client to send and execute arbitrary scripts on the server. | No | [Disable AJAXEvaluate](https://www.servicenow.com/docs/AdDbt2YWyoW9FDfMq7BTDw "Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls.") |
[ ]

{#exploring-high-security-settings__table_q1z_23k_nsb}

The following properties are defined in the sys_properties table, but are not visible on the High Security Settings page.
{#exploring-high-security-settings__table_jgq_1mk_nsb__entry__4}

| Property | Description | Default value | Instance Security Hardening Settings |
|-|-|-|-|
| com.glide.communications.httpclient.verify_hostname | Verify the hostname and certificate chain presented by remote SSL hosts. Protect against Man-In-The-Middle (MITM) attacks. For more detail, see [Set up Kubernetes spoke](https://www.servicenow.com/docs/access?context=set-up-kubernetes&version=zurich&pubname=zurich-integrate-applications&ft:locale=en-US) Note: This property overrides the com.glide.communications.trustmanager_trust_all property. | true | None |
| glide.basicauth.required.schema | Require basic authentication for inbound table schema requests. | true | None |
| glide.security.csrf_previous.allow | Allow usage of an expired secure token to identify and validate incoming requests. This token is used to prevent cross-site request forgery attacks. | false | None |
| glide.security.csrf_previous.time_limit | Time in seconds for a secure token to expire. Allows control over the length of time that the previous CSRF token is valid. When the user session expires, the secure token expires with it unless the glide.security.csrf_previous.allow property is enabled and it is within the timeframe described by this property. This token is used to prevent cross-site request forgery attacks. | 86400 Note: Value in seconds. Equivalent to 1 day. | None |
| glide.security.csrf.strict.validation.mode | Enforces strict validation on CSRF tokens so that users cannot resubmit a request if the CSRF token does not match. | false | [Prevent Users From Accepting Warning To Bypass CSRF Validation \[Updated in Security Center 1.3 and 1.5\]](3a1pvYjyRW58WFvKUtz8uA "Use the glide.security.csrf.strict.validation.mode property to enable CSRF token strict validation. If the CSRF token doesn't match, it prevents resubmission of the request.") |
| com.glide.security.check_unsanitized_html | Enforces sanitization behavior of translated_html fields on a global level for field assignments. | enforce | None |
[ ]

{#exploring-high-security-settings__table_jgq_1mk_nsb}

*[\>]: and then