--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Session validation context # Session validation context {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Session validation context The Session Validation Context provides an additional security layer to protect ServiceNow instances against session or cookie hijacking by validating user session IP addresses. It operates with the Adaptive authentication policy framework, which evaluates authentication requests and determines access based on defined policies and conditions. This feature is applied post-login to ensure that user sessions remain secure during active sessions. Show full answer Show less ## Key Features * **IP Address Validation:** Captures and stores the user's IP address at session creation and restricts access if subsequent requests come from different IP addresses or outside predefined valid IP ranges. * **Integration with Authentication Policies:** Used as an Allow Policy within the adaptive authentication framework to enforce IP restrictions for logged-in users. * **Policy Configuration:** Policies can be tailored using IP, Role, and Group criteria to specify which users or groups the restrictions apply to. * **Post-Login Execution:** Only applies to authenticated user sessions and executes on post-login requests, not on guest sessions or native mobile app sessions. ## Practical Use and Configuration Administrators can configure the Session Validation Context through its policy context record by defining: * **Default Policy:** Determines the default access behavior, either denying all users except those meeting Allow Policy conditions or allowing all users except those meeting Deny Policy conditions. * **Allow or Deny Policy:** Specifies the actual policy containing filters and conditions based on IP, Role, and Group criteria that govern session access. The Policy Input and Policy Conditions tabs provide a reference for the configured policies but require navigation to the respective policy records for modifications. ## Benefits * Protects against session hijacking by ensuring sessions cannot be impersonated from different IP addresses. * Enhances security by restricting session access when users connect from insecure or unauthorized networks. * Allows granular control of session access based on user roles or groups, ensuring compliance with organizational security policies. Use the Session Validation Context as an additional layer of protection against session or cookie hijacking. You can use the Session Validation Context with the [Adaptive authentication](https://www.servicenow.com/docs/CZ1~TzEChB9sygj2Nrp~gg "Use the Adaptive authentication policy framework to enforce contextual authentication controls to the right users at the right time. Adaptive authentication uses authentication policies to evaluate authentication requests and then either deny or allow access to your instance based on the specified policy conditions.") policy framework. The framework uses authentication policies to evaluate authentication requests and then either denies or allows access based on policy inputs and conditions. The Session Validation Context policy can be used in conjunction with post auth policy, where an admin can enforce IP restrictions to certain or all users during the logged in session. The Session Validation Context feature evaluates the IP-addresses based on the conditions you set and allows access to the instance within a session. The Session Validation Context outcome is set based on selecting Allow Policy as this policy terminates the user session immediately unless one of the policy conditions defined in the allow access policy evaluates to true. Note: The Session Validation Context for an authentication policy can only be with Allow Policy. The Session Validation Context works based on the following mechanism: * Captures the user's IP address on session creation from user request and stores it in the session and database. * Rejects a request when its IP address differs from that in the session or outside of the customer defined valid IP ranges you defined. {#session-context__ul_p2g_z11_pzb} Note: The Session Validation Context is: * Available only for authenticated users. * Not applicable for guest user sessions or native mobile apps. * Optional and based on the requirement that it can be configured. * Executed only for the post-login requests. {#session-context__ul_m13_1d1_pzb} ## Benefits of Session Validation {#session-context__section_eyc_g11_pzb} The Session Validation Context has the following benefits: * Restricts access to ServiceNow® when hijackers copy a user's session cookies from one device to another to impersonate the session. * Restricts the user's session access if they're using an insecure network. * Configures the various rules and IP ranges by user group or role for user logins. {#session-context__ul_hpd_311_pzb} ## Session Validation context record {#session-context__section_rqw_y2r_2qb} Policies in the session validation context execute post-login requests. Use the fields in the session validation policy context record to define how your instance uses your policy. {#session-context__table_otz_ngr_2qb__entry__2} | Field | Description | |-|-| | Name | Name of the policy context. This field is static and can't be changed. | | Description | Description of the context. | | Default Policy | Defines the default behavior of this context when evaluating the policy. Select from the following options. Allow Policy : Denies access to all users by default, and only allows access when the conditions in the Allow Policy field evaluate to true. Deny Policy : Allows access to all users by default, and only denies access when the conditions in the Deny Policy field evaluate to true. | | Allow Policy | The policy used for this context. This field appears only when the Default Policy field is set to Allow Policy. | | Deny Policy | The policy used for this context. This field appears only when the Default Policy field is set to Deny Policy. | [Table 1. Session Validation context form] {#session-context__table_otz_ngr_2qb} You can choose the Session Validation Policy as Allow Policy or Deny Policy based on the policy input and policy conditions. Note: You can only use the IP, Role, and Group filter criteria for Session Validation policy. ## Policy inputs and conditions {#session-context__section_uw4_vhr_2qb} The Policy Input and Policy Conditions tabs display the inputs and conditions of the policy selected in the Allow Policy or Deny Policy field. These tabs serve as a reference; but they can't be used to change the policy inputs or conditions. To modify your policy, navigate to the policy using the reference icon next to the Allow Policy or Deny Policy field.