---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce oauth state parameter validation

# Enforce oauth state parameter validation {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure the glide.oauth.state.parameter.required property to prevent your instance from cross-site request forgery (CSRF) attacks.
The glide.oauth.state.parameter.required system property enables the State parameter to be required in an OAuth request for authorization code flow. Beginning in the Madrid release, the
system property glide.oauth.state.parameter.required adds a State parameter for an OAuth request. For zbooted instances, the property is true. For upgraded
instances, the property is not present, so the State parameter is not enabled. The State parameter is a string value, and should not contain special characters. The State parameter
cannot be empty or " ". Not setting the State parameter to true ensures that an attacker cannot perform CSRF attacks during authentication can allow an attacker to perform operations as
the victim.

Ensure that the property glide.oauth.state.parameter.required is set to true.

## More information {#sc-enforce-oauth-state-parameter-validation__section_wc1_cqn_phc}

{#sc-enforce-oauth-state-parameter-validation__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.oauth.state.parameter.required |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.2 * CVSS rating: Medium * Security risk details: Not enabling the glide.oauth.state.parameter.required property in OAuth authorization code flow increases the risk of Cross-Site Request Forgery (CSRF) attacks, potentially allowing attackers to impersonate users and perform unauthorized actions. {#sc-enforce-oauth-state-parameter-validation__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-enforce-oauth-state-parameter-validation__table_ajc_b43_3kb}