---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit integrations' active session life span

# Limit integrations' active session life span {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.integrations.active.session.life_span property to enforce the maximum lifespan on active integration HTTP sessions, regardless of session inactivity.
The configured value is in minutes. A value of zero disables the lifespan limit entirely, allowing sessions to persist indefinitely until the inactive timeout fires. This particular property is limited to integrations that have
low-privilege access to an instance.

A larger maximum lifespan allows an attacker to persist a stolen session for longer, increasing the scope of a security incident.

To configure the glide.integrations.active.session.life_span propeerty:

1. Navigate to /sys_properties_list.do on the instance.
2. Ensure the glide.integrations.active.session.life_span property exists and is set to a value greater than <kbd class="ph userinput">0</kbd> and less than or equal to <kbd class="ph userinput">720</kbd> minutes.
{#sc-limit-integrations-active-session-life-span__ol_remediation_steps}

## More information {#sc-limit-integrations-active-session-life-span__section_wc1_cqn_phc}

{#sc-limit-integrations-active-session-life-span__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.integrations.active.session.life_span |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | Between 1 and 720 |
| Default value | 0 |
| Fallback value | 0 |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.2 * CVSS rating: Medium * Security risk details: A larger maximum lifespan allows an attacker to persist a stolen session for longer, increasing the scope of a security incident. {#sc-limit-integrations-active-session-life-span__ul_g1g_3sf_xwb} |
| Functional impact | Integration sessions that exceed the configured lifespan are silently invalidated and reissued a new session ID. The integration user sees no error, but any session-scoped state accumulated during that session is lost and starts fresh. |
| Dependencies and prerequisites | This control interacts with the glide.integration.session_timeout property, which controls the integration idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the integration idle timeout. If the active session lifespan is configured lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout. The platform logs a warning message when this occurs. |
[ ]

{#sc-limit-integrations-active-session-life-span__table_ajc_b43_3kb}