---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit guest's active session life span

# Limit guest's active session life span {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.
The glide.guest.active.session.life_span property enforces a maximum lifespan on active guest HTTP sessions, regardless of the session activity. The configured value is in minutes. A value of zero disables the lifespan limit entirely, allowing sessions to persist indefinitely until the inactive timeout fires. Guest users are unauthenticated users who access the instance without logging in.

A larger maximum lifespan allows an attacker to persist a stolen session for longer, increasing the scope of a security incident.

Navigate to /sys_properties_list.do on the instance and verify that the glide.guest.active.session.life_span property exists and is set to a value greater than 0 and less than or equal to 720 minutes.

## More information {#sc-limit-guests-active-session-life-span__section_wc1_cqn_phc}

{#sc-limit-guests-active-session-life-span__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.guest.active.session.life_span |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | integer |
| Recommended value | 720 |
| Default value | 0 |
| Fallback value | 0 |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: A larger maximum lifespan allows an attacker to persist a stolen session for longer, increasing the scope of a security incident. {#sc-limit-guests-active-session-life-span__ul_vyn_fwf_p3c} |
| Functional impact | Guest HTTP sessions that exceed the configured lifespan are silently invalidated and reissued a new session ID. The guest user sees no error or logout screen, but any session-scoped state (for example, in-progress form data, embedded portal widget context, or session-based rate limiting) accumulated during that session is lost and starts fresh. Legitimate guest users on long-running but otherwise idle browser tabs require reloading the page after the configured interval elapses. |
| Dependencies and prerequisites | This control interacts with the glide.guest.session_timeout property, which controls the guest idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message. |
[ ]

{#sc-limit-guests-active-session-life-span__table_ajc_b43_3kb}