---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable UserCookie version 3.1

# Enable UserCookie version 3.1 {#ariaid-title1}

Release version: Australia  
Updated March 13, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.
UserCookie v3 is generated only when property glide.ui.secure.cookies.use_kmf is disabled is disabled. UserCookie v3 is not secure due to storing secret key for HMAC in source code and identical for all
customers. By setting the property glide.ui.secure.cookies.use_kmf to true, UserCookie v3.1 is used and secret key is stored in security storage such as KMF.

## More information {#sc-enable-usercookie-version-3-1__section_ghv_dvg_1xb}

{#sc-enable-usercookie-version-3-1__table_hhv_dvg_1xb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.secure.cookies.use_kmf |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Category | [Session management](https://www.servicenow.com/docs/jJnJ0Q0eYjnQREHSQvPPjA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 7.1 * CVSS score: High * Security risk details: This creates a significant risk of session hijacking, as attackers who obtain or reverse-engineer the key can forge authentication cookies and impersonate users. {#sc-enable-usercookie-version-3-1__ul_ihv_dvg_1xb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-usercookie-version-3-1__table_hhv_dvg_1xb}