--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Session validation context # Session validation context {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Session validation context The Session Validation Context provides an additional security layer to protect against session or cookie hijacking in ServiceNow. It works with the Adaptive Authentication Policy framework, which evaluates authentication requests and determines access based on defined policies and conditions. This context enforces IP restrictions during a user's logged-in session by validating the user's IP address against stored session data and configured IP ranges. Show full answer Show less This feature activates only for authenticated users, executes on post-login requests, and is optional to configure. It does not apply to guest sessions or native mobile apps. ## Key Features * Captures and stores the user's IP address at session creation for validation throughout the session. * Rejects access if the IP address in the request differs from the session IP or falls outside allowed IP ranges. * Integrated with Adaptive Authentication policies using an Allow Policy model that denies access unless conditions are met. * Supports configuring policies based on IP, user roles, and groups only. * Policy inputs and conditions for session validation are referenced but must be modified directly in the associated Allow Policy record. ## Benefits * Prevents unauthorized access when session cookies are stolen and used from different devices. * Limits session access when users connect from insecure or untrusted networks. * Enables granular control by applying IP-based restrictions tailored to specific user groups or roles. ## Configuration Details The Session Validation Context is managed via a policy context record with key fields including: * **Name:** Identifies the policy context (static, cannot be changed). * **Description:** Provides details about the context. * **Default Policy:** Must be set to Allow Policy, which denies access by default and only permits it when policy conditions are true. * **Allow Policy:** Defines the specific policy used to evaluate session validation conditions. Administrators must configure the Allow Policy separately to define inputs and conditions such as IP ranges, roles, and groups. These configurations determine the precise validation rules applied during user sessions. Use the Session Validation Context as an additional layer of protection against session or cookie hijacking. You can use the Session Validation Context with the [Adaptive authentication](https://www.servicenow.com/docs/RECnBVWW10BjzyUlv_wSVQ "Use the Adaptive authentication policy framework to enforce contextual authentication controls to the right users at the right time. Adaptive authentication uses authentication policies to evaluate authentication requests and then either deny or allow access to your instance based on the specified policy conditions.") policy framework. The framework uses authentication policies to evaluate authentication requests and then either denies or allows access based on policy inputs and conditions. The Session Validation Context policy can be used in conjunction with post auth policy, where an admin can enforce IP restrictions to certain or all users during the logged in session. The Session Validation Context feature evaluates the IP-addresses based on the conditions you set and allows access to the instance within a session. The Session Validation Context outcome is set based on selecting Allow Policy as this policy terminates the user session immediately unless one of the policy conditions defined in the allow access policy evaluates to true. Note: The Session Validation Context for an authentication policy can only be with Allow Policy. The Session Validation Context works based on the following mechanism: * Captures the user's IP address on session creation from user request and stores it in the session and database. * Rejects a request when its IP address differs from the one in the session, or when it is outside the valid IP ranges that you define. {#session-context__ul_p2g_z11_pzb} Note: The Session Validation Context is: * Available only for authenticated users. * Not applicable for guest user sessions or native mobile apps. * Optional and based on the requirement that it can be configured. * Executed only for the post-login requests. {#session-context__ul_m13_1d1_pzb} ## Benefits of Session Validation {#session-context__section_eyc_g11_pzb} The Session Validation Context has the following benefits: * Restricts access to ServiceNow® when hijackers copy a user's session cookies from one device to another to impersonate the session. * Restricts the user's session access if they're using an insecure network. * Configures the various rules and IP ranges by user group or role for user logins. {#session-context__ul_hpd_311_pzb} ## Session Validation context record {#session-context__section_rqw_y2r_2qb} Policies in the session validation context execute post-login requests. Use the fields in the session validation policy context record to define how your instance uses your policy. {#session-context__table_otz_ngr_2qb__entry__2} | Field | Description | |-|-| | Name | Name of the policy context. This field is static and can't be changed. | | Description | Description of the context. | | Default Policy | Defines the default behavior of this context when evaluating the policy. Select from the following options. Allow Policy : Denies access to all users by default, and only allows access when the conditions in the Allow Policy field evaluate to true. | | Allow Policy | The policy used for this context. This field appears only when the Default Policy field is set to Allow Policy. | [Table 1. Session Validation context form] {#session-context__table_otz_ngr_2qb} The Session Validation Policy uses Allow Policy, based on the policy input and policy conditions. Note: You can only use the IP, Role, and Group filter criteria for Session Validation policy. ## Policy inputs and conditions {#session-context__section_uw4_vhr_2qb} The Policy Input and Policy Conditions tabs display the inputs and conditions of the policy selected in the Allow Policy field. These tabs serve as a reference; but they can't be used to change the policy inputs or conditions. To modify your policy, navigate to the policy using the reference icon next to the Allow Policy field.