---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Minimize absolute session timeout duration

# Minimize absolute session timeout duration {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the
cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance.
If the glide.ui.user_cookie.max_life_span_in_days system property is not set to the recommended value of <kbd class="ph userinput">30</kbd> or other appropriate value, then a very long life session could be more
vulnerable to session hijack attacks.

Ensure that the property glide.ui.user_cookie.max_life_span_in_days is set to <kbd class="ph userinput">30</kbd> or less.  
Note:  
To enforce a maximum session time for any active user sessions, see [Managing user sessions](https://www.servicenow.com/docs/access?context=c_ManageUserSessions&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US).

## More information {#sc-absolute-session-timeout__section_wc1_cqn_phc}

{#sc-absolute-session-timeout__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.user_cookie.max_life_span_in_days |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | 30 or less |
| Default value | 30 |
| Fallback value | 30 |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.2 * CVSS rating: Medium * Security risk details: A long session lifespan extends the window of opportunity for attackers to hijack active sessions, increasing the likelihood of unauthorized access if credentials or session tokens are compromised. {#sc-absolute-session-timeout__ul_g1g_3sf_xwb} |
| Functional impact | This property enforces mandatory re-login by avoiding any sort of cookie rotation after a given time frame. |
| Dependencies and prerequisites | None |
[ ]

{#sc-absolute-session-timeout__table_ajc_b43_3kb}