---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable Anti-CSRF Token for Userperf

# Enable Anti-CSRF Token for Userperf {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use a system property to ensure CSRF (Cross-Site Request Forgery) protection is enforced when setting user preferences.
Use the glide.security.userpref_csrf_check.enable system property to enforce CSRF (Cross-Site Request Forgery) protection when setting user preferences to the User Preference Definitions
\[sys_user_preference_definition\] table via URI parameters. If the property isn't set to the recommended value of <kbd class="ph userinput">true</kbd>, then the CSRF token required flag is overridden when set on
individual preferences, and preferences can be set via URI parameters without requiring a CSRF token.

Ensure the glide.security.userpref_csrf_check.enable system property is set to <kbd class="ph userinput">true</kbd>.

## More information {#sc-enable-anti-csrf-token-for-userperf__section_mgt_bsn_rhc}

{#sc-enable-anti-csrf-token-for-userperf__table_ygy_csn_rhc__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.userpref_csrf_check.enable |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 4.3 * CVSS score: Medium * Security risk details: Failure to implement CSRF protection exposes the instance to unauthorized actions performed on behalf of authenticated users. {#sc-enable-anti-csrf-token-for-userperf__ul_zgy_csn_rhc} |
| Functional Impact | Users or integrations that previously set certain preferences via URL parameters without a CSRF token may now fail if those preferences require a token. |
| Dependencies and prerequisites | None |
| References |   |
[ ]

{#sc-enable-anti-csrf-token-for-userperf__table_ygy_csn_rhc}