---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce URL allowlist check

# Enforce URL allowlist check {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.
If the glide.security.url.whitelist.strict_check system property isn't set to the recommended value of true then all external URLs are allowed for redirection when
glide.security.url.whitelist is empty. If glide.security.url.whitelist is not empty, then only external URLs in the list are allowed. Either setting
glide.security.url.whitelist.strict_check to true or ensuring glide.security.url.whitelist is set to a non-empty value with the allowed external URLs leaves the
instance in a secure state.

Ensure that the property glide.security.url.whitelist.strict_check is set to true or the property glide.security.url.whitelist.strict_check is set to a
value.

## More information {#sc-enforce-url-allowlist-check__section_wc1_cqn_phc}

{#sc-enforce-url-allowlist-check__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * glide.security.url.whitelist.strict_check * glide.security.url.whitelist {#sc-enforce-url-allowlist-check__ul_rh4_s3n_p3c} |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | * Boolean * String {#sc-enforce-url-allowlist-check__ul_lm1_1jn_p3c} |
| Recommended value | * true * Comma-separated of permitted URLs {#sc-enforce-url-allowlist-check__ul_png_bjn_p3c} |
| Default value | \<none\> |
| Fallback value | * true * \<empty\> {#sc-enforce-url-allowlist-check__ul_sbf_cjn_p3c} |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/qvFon3mPY~i4OtLtQVS_QQ "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 6.3 * CVSS rating: Medium * Security risk details: If all external URLs are allowed for redirection, this could allow an attacker to redirect a user to a malicious website. {#sc-enforce-url-allowlist-check__ul_g1g_3sf_xwb} |
| Functional impact | This remediation enforces validation on logout page. It might have a functional impact on a user of an instance with an SSO/SAML configuration. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enforce-url-allowlist-check__table_ajc_b43_3kb}