---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Explore Web service security
# Explore Web service security {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Explore Web Service Security
This content explains how to enforce security on ServiceNow web services using Basic Authentication, mutual authentication, or WS-Security, focusing primarily on Basic Authentication.
It guides ServiceNow customers on configuring and implementing security to control access to WSDL documents and SOAP message postings.
Show full answer Show less
## Basic Authentication
To require Basic Authentication for each web service request, set the system property **glide.basicauth.required** to **true**. This mandates that every request includes an "Authorization" header complying with the Basic Authentication protocol. Supplying these credentials ensures actions performed via the web service are attributed to the authenticated user rather than the default Guest user, which is important for audit trails and accountability.
To handle case insensitivity in authorization headers, the property **glide.security.script.include.name.case.insensitive.list** can be modified in the System Properties table to include necessary script includes (default values include *BasicAuth* and *CustomAuth*).
## Implementation Examples
The content provides practical examples of how to supply Basic Authentication credentials in various programming environments commonly used by ServiceNow customers:
* **Perl**: Using SOAP::Lite library by defining a function returning username and password.
* **C# .NET (VS 2005 or older)** : Using `System.Net.NetworkCredential` assigned to the proxy's Credentials property.
* **C# .NET (VS 2008)** : Using `ClientCredentials.UserName` properties and updating the app.config file to specify `clientCredentialType="Basic"` for transport security.
* **VB .NET** : Setting credentials with `System.Net.NetworkCredential` and assigning to the proxy object.
## Expected Behavior and Error Handling
If Basic Authentication is enabled but credentials are not supplied in a request, the web service responds with an HTTP 401 Unauthorized error. This standard security response indicates the request requires authentication credentials and prevents unauthorized access.
## Practical Impact for ServiceNow Customers
By enabling Basic Authentication on web services, ServiceNow customers can:
* Ensure that only authorized users can access or modify data via SOAP web services.
* Accurately record which user initiated changes, improving traceability and compliance.
* Integrate securely with external applications and scripts using supported authentication methods and examples provided.
This guidance helps customers implement robust security on web service endpoints, safeguarding data and maintaining proper user accountability within their ServiceNow environments.
Enforce security using basic authentication, mutual authentication, or WS-Security.{#exploring-web-sec__web-service-desc}
## Basic Authentication {#exploring-web-sec__section_ykq_tt4_ryb}
To enforce basic authentication on each request for a WSDL document or posting of SOAP messages, you may set the property glide.basicauth.required to true. If you do so, each WSDL or SOAP
request would have to contain the "Authorization" header as specified in the [Basic Authentication](http://www.w3.org/Protocols/HTTP/1.0/draft-ietf-http-spec.html#BasicAA) protocol. Because the request is non-interactive, the Authorization header is always required during a request.
Supplying basic authentication information whether or not it is required has the added advantage that the data created or updated as a result of the Web Service invocation is done on behalf of the user supplied in the basic
authentication credentials. As an example, when creating an Incident record, the journal fields have the user id of the basic authenticated user, instead of the default Guest user.
To make the authorization header ignore the capitalization rules, use the glide.security.script.include.name.case.insensitive.list property. You can modify this property in the System Properties \[sys_properties\] table and add the script includes that are necessary to process the authentication. By default, this property has these values:
* BasicAuth
* CustomAuth
{#exploring-web-sec__ul_mx4_1qz_k1b}Add other script includes as needed.
To supply basic authentication when using Perl and the SOAP::Lite libraries, you can implement the following function:
sub SOAP :: Transport :: HTTP :: Client :: get_basic_credentials { return 'user_name' => 'password' ; }
* When using C# .NET VS 2005 or older, you can take advantage of the Credentials object, for example:
System.Net . ICredentials cred = new System.Net . NetworkCredential ( "user_name", "password" ) ;
service . ServiceNow proxy = new service . ServiceNow ( ) ;
service . get getService = newservice . get ( ) ;
service . getResponse getServiceResponse = new service . getResponse ( ) ;
try {
proxy . Credentials = cred ;
getService . sys_id = "bf522c350a0a140701972dbf876f1610" ;
getServiceResponse = proxy . get (getService ) ; catch (Exception ex ) { }
* When using C# .NET VS 2008, you can take advantage of the ClientCredentials object, for example:
Demo_Incident. ServiceNowSoapClient client = new Test08WebService . Demo_Incident . ServiceNowSoapClient ( ) ;
client . ClientCredentials . UserName . UserName = "admin" ;
client . ClientCredentials . UserName . Password = "admin" ;
Then in your app.config file look for the following and change None to Basic:
* When using VB .NET taking advantage of the Credentials object would look like the following:
Sub Main()
Dim cred As New System.Net.NetworkCredential( "user_name", "password")
Dim proxy As New VB_Democm.incident.ServiceNow
Dim getIncident As New VB_Democm.incident. get Dim getResponse As New VB_Democm.incident.getResponse
proxy.Credentials = cred
getIncident.sys_id = "[your sysID here]"
getResponse = proxy. get(getIncident)
End Sub
The resulting response when Basic Authentication is turned on and no credentials are supplied looks like this:
Apache Tomcat/5.0.28 - Error report </ title > <style > <!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} A {color : black;} A.name {color : black;} HR {color : #525D76;}--> </ style > </ head > <body > <h1 >HTTP Status 401 -\ </ h1 > <HR size = "1" noshade = "noshade" > <p >< b >type </ b > Status report </ p > <p >< b >message </ b > <u >< / u >< / p > <p >< b >description </ b > <u >This request requires HTTP authentication (). </ u >< / p > <HR size = "1" noshade = "noshade" > <h3 >Apache Tomcat/5.0.28 </ h3 > </ body > </ html >
{#exploring-web-sec__ul_bzb_lvt_t4}