---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Block Expired Anti-CSRF Tokens

# Block Expired Anti-CSRF Tokens {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Block expired CSRF tokens to prevent cross-site request forgery attacks.
The glide.security.csrf_previous.allow system property enables use of an expired secure token to identify and validate incoming requests. This token is used to prevent cross-site request forgery attacks.

Ensure that the property glide.security.csrf_previous.allow is set to false.

## More information {#sc-block-expired-csrf-tokens__section_wc1_cqn_phc}

{#sc-block-expired-csrf-tokens__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.csrf_previous.allow |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | true |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 6.5 * CVSS rating: Medium * Security risk details: Allowing the use of previous or expired CSRF tokens exposes the application to replay attacks, enabling attackers to reuse valid requests and potentially perform unauthorized actions on behalf of legitimate users. {#sc-block-expired-csrf-tokens__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-block-expired-csrf-tokens__table_ajc_b43_3kb}