---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Enable CSRF enforcement for authenticated processors
# Enable CSRF enforcement for authenticated processors {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Enable CSRF enforcement for authenticated processors
This feature enables Cross-Site Request Forgery (CSRF) enforcement specifically for authenticated processor requests in ServiceNow, protecting against CSRF attacks when session cookies are used for authentication.
CSRF enforcement checks are applied after successful session cookie authentication to ensure requests are genuine and authorized.
Show full answer Show less
## Key Features
* **CSRF Enforcement Property:** The `glide.security.csrf.processor.all.authenticated.enabled` system property activates CSRF validation for authenticated processor requests using session cookies.
* **Request Types Protected:** Enforcement applies to state-changing HTTP methods: POST, PUT, and DELETE. GET requests remain exempt and do not require CSRF tokens.
* **Allow-list for Exceptions:** The `glide.security.csrf.httpauthprocessorallowlist` property allows specific processors extending `HTTPAuthProcessor` to bypass CSRF enforcement, enabling exceptions for trusted or legacy integrations.
* **Security Priority:** This property supersedes `glide.security.csrf.rest.publiccsrf.enabled` for cookie-authenticated REST traffic, applying a broader enforcement scope.
## Practical Impact for ServiceNow Customers
* **Security Enhancement:** Enabling this property strengthens defenses against CSRF attacks that exploit authenticated session cookies, preventing unauthorized state changes initiated by malicious sites.
* **Integration Considerations:** Activating enforcement may cause previously functioning integrations or custom clients relying on session cookies without valid CSRF tokens to receive HTTP 401 Unauthorized errors. Customers should verify and update clients to include valid CSRF tokens.
* **Testing Recommendations:** Perform regression testing by sending POST, PUT, and DELETE requests to the affected processors with no token, invalid tokens, and valid tokens to confirm correct enforcement behavior. Ensure GET requests continue to operate without CSRF tokens.
* **Backward Compatibility:** Disabling this property preserves compatibility with legacy clients but reduces security against CSRF risks.
## Configuration Details
* **Properties:** Configure `glide.security.csrf.processor.all.authenticated.enabled` (Boolean) to `true` to enable enforcement and `glide.security.csrf.httpauthprocessorallowlist` (String) to specify processors exempt from enforcement.
* **Default Values:** Both properties default to `false` and empty string respectively, meaning enforcement is off by default.
* **Logging and Rejections:** Requests failing CSRF validation are rejected with HTTP 401 responses and detailed logs are generated for audit and troubleshooting.
Enable Cross-Site Request Forgery (CSRF) enforcement to protect authenticated processor requests from CSRF attacks when session cookies are used for authentication.
The glide.security.csrf.processor.all.authenticated.enabled property enables CSRF checks for authenticated processor requests. When set to true, the platform checks for CSRF violations after session cookie authentication succeeds. If a violation is detected and the processor is not allow-listed, the request is rejected with an HTTP 401 response. Rejection details are logged. This enforcement applies to POST, PUT, and DELETE requests. GET requests are allowed without a CSRF token.
The glide.security.csrf.httpauth_processor_allowlist property controls an exception list that allows specific processors extending HTTPAuthProcessor to bypass CSRF enforcement. When glide.security.csrf.processor.all.authenticated.enabled is active, requests to processors named in this allow-list bypass the HTTP 401 rejection for invalid or missing CSRF tokens.
Note:
The glide.security.csrf.processor.all.authenticated.enabled property is a broader upstream gate that supersedes glide.security.csrf.rest.public_csrf.enabled for cookie-auth REST traffic when both are enabled. The glide.security.csrf.rest.public_csrf.enabled property is effectively the specific guard for public REST API pages that the glide.security.csrf.processor.all.authenticated.enabled property does not cover (for example, public REST requests sent with a session cookie where the page does not require cookie authentication).
## More information {#sc-enable-csrf-enforcement-for-authenticated-processors__section_more_info}
{#sc-enable-csrf-enforcement-for-authenticated-processors__table_csrf_enforcement__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | glide.security.csrf.processor.all.authenticated.enabled, glide.security.csrf.httpauth_processor_allowlist |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Data type | Boolean, String |
| Recommended value | glide.security.csrf.processor.all.authenticated.enabled: true glide.security.csrf.httpauth_processor_allowlist: "" |
| Default value | glide.security.csrf.processor.all.authenticated.enabled: false glide.security.csrf.httpauth_processor_allowlist: "" |
| Fallback value | glide.security.csrf.processor.all.authenticated.enabled: false glide.security.csrf.httpauth_processor_allowlist: "" |
| Security risk | Setting the glide.security.csrf.processor.all.authenticated.enabled property to false disables CSRF token validation for authenticated processor requests, allowing CSRF attacks when session cookies are used for authentication. A CSRF attack tricks an authenticated user's browser into making requests to a web application on the attacker's behalf, without the user's knowledge. The browser automatically attaches session cookies to outbound requests. A malicious page can silently trigger state-changing actions (password changes, record updates, privilege escalations) on any site the victim is currently logged in. The impact scales with the victim's privileges. A regular user loses control of their own account. An administrator can expose the entire instance. |
| Functional impact | Changing the glide.security.csrf.processor.all.authenticated.enabled property directly affects whether requests that change state and are authenticated via session cookies to HTTPAuthProcessor-based endpoints must present a valid CSRF token. Enabling this property can cause previously working integrations, browser-driven calls, or custom clients to start receiving HTTP 401 responses. This occurs if they rely on session cookies but don't send a valid X-UserToken. Disabling it preserves backward compatibility for such clients but weakens CSRF protection. |
| Regression testing | Log in to establish a session and call an affected processor endpoint using POST, PUT, or DELETE in three ways: without a token, with an invalid token, and with a valid token. When the property is enabled, the requests without a token, and those with an invalid token are rejected. The requests with a valid token should succeed. Confirm GET requests continue to work without requiring a CSRF token. |
| Related property | glide.security.csrf.httpauth_processor_allowlist |
[ ]
{#sc-enable-csrf-enforcement-for-authenticated-processors__table_csrf_enforcement}