---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configure session validation

# Configure session validation {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure session validation within the Adaptive Authentication framework to provide an additional layer of protection for session or cookie hijacking.

## Before you begin

Role required: adaptive_auth_admin

Plugin required: Adaptive Authentication (com.snc.adaptive_authentication)

To configure Session Validation, you must perform the following steps:

## Procedure

1. Navigate to AllAdaptive AuthenticationAuthentication PoliciesAll Policies.
2. Select the Session Validation Policy in the Policies (sys_authentication_policy_list.do) page.
3. Select Policy Inputs.
   1. Select New or Edit.
   2. Choose the kind of Policy Input (Filter Criteria) to create.  
      Available options are IP, Role, and Group Filter Criteria. Let's choose IP Filter Criteria.
   3. Fill the form with the filter details and provide the IP Range.  

      To learn more about how to create an IP Filter, see [Create IP filter criteria](https://www.servicenow.com/docs/LnqmosZAmqs1aTZ6d6OGRg "IP filter criteria enables you to filter users based on the user's IP addresses. You can configure an authentication policy to allow or deny access to a specific address or range of addresses.").
   4. Select Submit.
   {#use-ip-session-context__substeps_b2y_db5_rzb}
4. Select Policy Conditions on the Session Validation Policy page.
   1. Select New.
   2. Fill the form and set the Condition for the Policy Input.  
      Note:  
      You can set the conditions to <kbd class="ph userinput">true</kbd> or <kbd class="ph userinput">false</kbd> based on the configuration of the policy input. In this example, it is set to <kbd class="ph userinput">true</kbd>. Setting the condition to true in this case allows only the user with the configured IP address to log in.
   {#use-ip-session-context__substeps_fmn_4c5_rzb}
5. Select the Active check box to activate the policy after the Session Validation Policy is set up with policy inputs and conditions.  
6. Navigate to AllAdaptive AuthenticationAuthentication PoliciesProperties and enable the Session Validation property.  
7. Navigate to AllAdaptive AuthenticationAuth Policy ContextsSession Validation Context.
8. Set the Default Policy to Allow Policy to set the session validation context according to the policy input and policy conditions.  
   Note:  
   By default:
   * The Session Validation context is set to Allow Policy.
   * Allow Policy is selected as Session Validation Policy.
   * The Session Validation Context for an authentication policy can only be with Allow Policy.
   {#use-ip-session-context__ul_tpq_rj5_rzb}

## Result

The configuration evaluates the login session based on the following:

* Restricts access to the ServiceNow® instance when hijackers copy a user's session cookies from one device to another to impersonate a session.
* Restricts the user's session access if they're using an insecure network.
{#use-ip-session-context__ul_hpd_311_pzb}

*[\>]: and then