---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable anti-CSRF token

# Enable anti-CSRF token {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.security.use_csrf_token property to confirm the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.
Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a web application, exploiting the web application's trust in an authenticated user.

The glide.security.use_csrf_token property controls whether the platform embeds a token in rendered pages and validates that token on incoming requests. This allows the platform to distinguish requests that originated from its own pages from requests forged by a third-party site.

To configure this property:

1. Confirm the current user has the security_admin role or has elevated to that role.
2. Navigate to /sys_properties_list.do on the instance.
3. Confirm the glide.security.use_csrf_tokenproperty exists and is set to <kbd class="ph userinput">true</kbd>.

## More information {#sc-anti-csrf-token__section_avc_lp4_fvb}

|-|-|
| Attribute | Description |
| Property name | glide.security.use_csrf_token |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Purpose | To protect the application from potential CSRF attack. |
| Fallback value | false |
| Recommended value | true |
| Default value | true |
| Functional impact | Requests with a missing, expired, or mismatched token are rejected and the user is redirected to a security warning page instead of having the action performed. |
| Security risk | * Security risk rating: High * CVSS rating: 8.1 * Security risk details: If this property is not set to <kbd class="ph userinput">true</kbd>, the platform can't distinguish a forged request from one the user actually intended. An attacker can craft a malicious page that causes an authenticated victim's browser to submit a request to the instance without their knowledge. That request executes with the victim's session and privileges. |
[ ]

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US).