Prevent Reuse of REST API Sessions in UI/Web

  • Rversion finale: Australia
  • Mis à jour 12 mars 2026
  • 1 minute de lecture

    • Prevent REST API session cookies from bypassing Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls using a system property.

    Use the com.glide.processors.aprocessor.donot_reuse_api_session to help prevent the cookies associated with the session created through the REST API from being reused to initiate UI/web sessions.

    Verify that com.glide.processors.aprocessor.donot_reuse_api_session exists in the System Properties [sys_properties] table and is set to true.

    More information

    Attribute Description
    Configuration name com.glide.processors.aprocessor.donot_reuse_api_session
    Configuration type System Properties (/sys_properties_list.do)
    Data type Boolean
    Recommended value true
    Default value true
    Fallback value false
    Category Session management
    Security risk
    • Severity score: 4.3
    • CVSS score: Medium
    • Security risk details: Reusing REST API session cookies for a web session bypasses Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls. This bypass can be an escalation of intended privileges. SSO and MFA controls are important requirements to help prevent unauthorized access to data.
    Functional impact

    When com.glide.processors.aprocessor.donot_reuse_api_session is set to true:

    • API session cookies can no longer be reused to initiate web sessions.
    • All web sessions require full authentication (SSO/MFA), regardless of any existing API session.

    Potential Breakage:

    • Custom integrations, scripts, or legacy workflows that relied on the ability to transition from an API session to a web session without re-authentication will fail.
    • Automated processes or tools that previously bypassed SSO/MFA using API session cookies are forced to complete the full authentication flow.
    • Users may experience unexpected authentication prompts if their workflows were implicitly relying on this behavior.

    Before enabling, customers should review integrations and customizations:

    • Audit all integrations, scripts, and tools that interact with the instance via API and web interfaces.
    • Identify any that may be relying on session cookie reuse for seamless transitions between API and web sessions.
    Dependencies and prerequisites None