---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict access to GlideSystemUserSession scriptable API

# Restrict access to GlideSystemUserSession scriptable API {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call
this method via script.
The methods gs.addErrorMessageNoSanitizationMessaging() and gs.addInfoMessageNoSanitization() are used within the scripting environment for logging and notifications. Both of these are
available in the sandbox if this property is not set to the recommended value of false. The sandbox is a low privileged scripting environment available to unauthenticated and no role users. Both of these
methods can be used to display unsanitized input to a user.

Ensure that the glide.sandbox.usersession.allow_unsanitized_messages system property is set to false. If this property does not exist on the System Properties \[sys_properties\] table,
create the property.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-access-glidesystemusersession-scriptable-api__section_wc1_cqn_phc}

{#sc-access-glidesystemusersession-scriptable-api__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.sandbox.usersession.allow_unsanitized_messages |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | true |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 8.1 * CVSS rating: High * Security risk details: Displaying unsanitized input to the user is dangerous, as unsanitized input may contain dangerous code that runs in the user's browser. This can be utilized for traditional reflected XSS attacks. Reflected XSS attacks can be used in multiple scenarios, including session hijacking. {#sc-access-glidesystemusersession-scriptable-api__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-access-glidesystemusersession-scriptable-api__table_ajc_b43_3kb}