---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Minimize session activity timeout duration

# Minimize session activity timeout duration {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.session_timeout property to designate, in
minutes, activity timeout value.
The glide.ui.session_timeout system property determines the user session timeout, which determines how long a user session stays active. If glide.ui.session_timeout is not set to the
recommended value of <kbd class="ph userinput">60</kbd> minutes or less, then the session may stay valid for long even without activity. This could provide too large of a time window to enable session hijacking attacks.

Ensure that the property glide.ui.session_timeout is set to <kbd class="ph userinput">60</kbd> or less.

## More information {#sc-session-activity-timeout__section_wc1_cqn_phc}

{#sc-session-activity-timeout__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.session_timeout |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | 60 or less |
| Default value | \<none\> |
| Fallback value | 30 |
| Category | [Session management](https://www.servicenow.com/docs/jJnJ0Q0eYjnQREHSQvPPjA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 7.5 * CVSS rating: High * Security risk details: A long session timeout allows inactive sessions to remain valid for extended periods, increasing the chance that an attacker could hijack the session before it expires. {#sc-session-activity-timeout__ul_g1g_3sf_xwb} |
| Functional impact | This remediation enforces timely expiration of user account. No functionality impact, however User experience is altered. |
| Dependencies and prerequisites | None |
[ ]

{#sc-session-activity-timeout__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).