---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Enable basic authentication restriction
# Enable basic authentication restriction {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 1 minute to read
The glide.authenticate.basic_auth.restriction.active property controls whether the platform evaluates inbound basic-auth API requests against allowed access paths.
This property controls the [Basic authentication restriction](https://www.servicenow.com/docs/DtVq0Y888SZu2DXEdYVpYg "Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.") gate. This gate evaluates inbound basic-auth API requests (username + password) from interactive-login accounts.
When set to true, the gate evaluates each request against allowed access paths. When set to false, every basic-auth API request bypasses evaluation.
Important:
Set to false only as a temporary emergency measure---for example, to restore basic-auth access during an active security investigation. Revert to true as soon as the emergency resolves.
## More information {#sc-enable-basic-auth-restriction__section_nrb_wpx_2kc}
{#sc-enable-basic-auth-restriction__table_lzs_xpx_2kcb__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.basic_auth.restriction.active |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: 8.1 * CVSS rating: High * Security risk details: When set to false, accounts that authenticate interactively through the browser or service portal can also authenticate to the API using only a username and password. This bypasses any multi-factor authentication that would otherwise be required for those accounts' interactive logins. This creates a credential-compromise attack path: an attacker who obtains a valid password through phishing, credential stuffing, or a prior breach can use it directly against the API without satisfying a second factor. Leaving this property set to false for an extended period removes multi-factor authentication (MFA) protection for every interactive-login account, substantially increasing the risk of account takeover. {#sc-enable-basic-auth-restriction__ul_g1g_3sf_xwb} |
| Functional impact | When set to true for the first time, the basic authentication restriction starts in tracking mode. Basic-auth requests are recorded (not restricted) in the exception table (sys_user_basic_auth_exception) for admin review. Actual restriction begins once the separate enforcement mechanism activates, at which point users who don't qualify under an allowed access path are denied access. If this property was previously set to false after enforcement began, setting it back to true resumes enforcement immediately. Tracking mode doesn't start. Before enforcement begins, administrators must review the exception table. Set an appropriate decision for each listed account. Convert integration accounts to Web Service Access Only where possible. Setting this property to false after enforcement has begun immediately restores unrestricted basic-auth access for every account including previously-restricted accounts. Set it back to true as soon as any investigation is complete. |
| Dependencies and prerequisites | The com.snc.integration.multifactor.authentication plugin must be active. |
[ ]
{#sc-enable-basic-auth-restriction__table_lzs_xpx_2kcb}