Enforce URL allowlist check [Updated in Security Center 1.3, 1.5, and 2.0]

  • Rversion finale: Australia
  • Mis à jour 12 mars 2026
  • 1 minute de lecture

    • Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.

    Protect your users from client-side open redirection, which enable attackers to redirect your users to untrusted and malicious pages.

    If glide.security.url.whitelist.strict_check is not set to the recommended value of true, all external URLs are allowed for redirection as long as the glide.security.url.whitelist system property is empty. If glide.security.url.whitelist is not empty, then only external URLs listed in that property are allowed.

    Set glide.security.url.whitelist.strict_check to true or ensure that glide.security.url.whitelist is configured with the allowed external URLs to help secure your instance from open redirection attacks.

    This property is applicable in the following cases:
    • /logout.do?sysparm_goto_url={External URL}
    • /cms_login_redirect.do?sysparm_goto_url={External URL}
    Users are directed to an external trusted site after they log out of the instance:
    • /logout_redirect.do?sysparm_url={External URL}
    • /saml_redirector.do?sysparm_uri={External URL}
    • /logout_success.do?RelayState={External URL}

    When SAML is enabled, it invokes an identity provider (IDP) logout URL.

    Ensure the property glide.security.url.whitelist.strict_check is set to true or the property glide.security.url.whitelist is set to a value.

    More information

    Attribute Description
    Property name glide.security.url.whitelist
    Configuration type System Properties (/sys_properties_list.do)
    Category Validation, sanitization, and encoding
    Purpose To implement safe URL redirect during login, logout, or other redirects. This property mitigates one of the OWASP top 10 attacks called Invalidated Redirects and forwards.
    Type String
    Default value true
    Recommended value true
    Value Your organization's approved URLs [Some Defined FQDN (Fully Qualified Domain Name) Ex. http://www.servicenow.com]
    Security risk rating 6.3
    Functional impact This remediation enforces validation on logout page. It might have a functional impact on a user of an instance with an SSO/SAML configuration.
    Security risk (High) Client-side open redirection can enable attacker to redirect victims/users to attacker-controlled website and is viewed as a security risk.
    References

    Multi-SSO (SAML 2.0) errors and fixes

    To learn more about adding or creating a system property, see Add a system property.