---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce strict user image upload

# Enforce strict user image upload {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.security.strict.user_image_upload property to enable access control for the upload/update of a profile picture when performed on a user record.
If the glide.security.strict.user_image_upload system property isn't set to true, the hostname and certificate chain presented by remote hosts during a TLS
connection initiated from the ServiceNow ServiceNow instance aren't validated.

This vulnerability compromises the security of the TLS connection and allows person-in-the-middle attacks, where communications between two parties are intercepted. This may lead to sensitive data disclosure.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Ensure the com.glide.communications.httpclient.verify_hostname property exists and is set to <kbd class="ph userinput">true</kbd>.
{#sc-enforce-strict-user-image-upload__ol_hn3_svk_hkc}

## More information {#sc-enforce-strict-user-image-upload__section_wc1_cqn_phc}

{#sc-enforce-strict-user-image-upload__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.strict.user_image_upload |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 3.7 * CVSS rating: Low * Security risk details: This vulnerability compromises the security of the TLS connection and allows person-in-the-middle attacks, where communications between two parties are intercepted. This may lead to sensitive data disclosure. {#sc-enforce-strict-user-image-upload__ul_g1g_3sf_xwb} |
| Functional impact | When the com.glide.communications.httpclient.verify_hostname property is set to <kbd class="ph userinput">true</kbd>, an outbound HTTPS connection is rejected if the remote host's certificate does not match the requested hostname or its certificate chain can't be validated. Outbound integrations to hosts with a mismatched or misconfigured certificate will fail to connect once this property is set to true. |
| Dependencies and prerequisites | The com.glide.communications.httpclient.verify_hostname property governs hostname and certificate chain validation independently of the com.glide.communications.httpclient.verify_revoked_certificate property, the overall gate for certificate revocation checking. |
[ ]

{#sc-enforce-strict-user-image-upload__table_ajc_b43_3kb}