---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# CSRF enforcement for session-authenticated REST APIs

# CSRF enforcement for session-authenticated REST APIs {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.security.csrf.rest.public_csrf.enabled property enables Cross-Site Request Forgery (CSRF) token validation for public REST APIs that use session-cookie authentication.
A CSRF token is a unique, session-specific security token embedded in requests. The server validates that the token matches the one it issued, confirming the request's legitimacy and preventing attackers from performing
unauthorized actions on behalf of users.

When the glide.security.csrf.rest.public_csrf.enabled property is set to <kbd class="ph userinput">true</kbd>, all public REST APIs using session-cookie authentication must include a valid CSRF token in their requests. Requests without a
valid token are rejected.

You can exempt specific REST API paths from CSRF validation by adding them to the sys_rest_csrf_allow_list table. Paths on this allowlist will not require CSRF tokens.

When the glide.security.csrf.rest.public_csrf.enabled property is set to <kbd class="ph userinput">false</kbd>, CSRF token validation is turned off entirely.

## More information {#sc-csrf-enforcement-for-session-authenticated-rest-apis__section_more_info}

{#sc-csrf-enforcement-for-session-authenticated-rest-apis__table_property_details__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.csrf.rest.public_csrf.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Security risk | * Security rating: Medium * CVSS score: 4.3 * Security risk details: Setting this property to <kbd class="ph userinput">false</kbd> disables CSRF token validation for public REST APIs, exposing them to potential CSRF attacks when using session cookies for authentication. A CSRF attack is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated. Typically enabled by social engineering, an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state-changing requests like changing their email address. If the victim is an administrative account, CSRF can compromise the entire web application. |
| Dependencies and prerequisites | None |
| Functional impact | Setting this property to <kbd class="ph userinput">true</kbd> may cause some customer instance scripts and integrations to break. However, this is only if these scripts and integrations rely on session cookie authentication and make requests to public REST API endpoints without including a valid CSRF token. Integrations that use supported authentication methods (such as OAuth or basic auth) or correctly include the CSRF token will continue to work without changes. |
[ ]

{#sc-csrf-enforcement-for-session-authenticated-rest-apis__table_property_details}