---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Proactively invalidate sessions after defined durations

# Proactively invalidate sessions after defined durations {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.active.session.timeout.invalidate.session property controls whether a timed-out session is proactively invalidated before the Tomcat server processes it.
When this property value isn't set to true, there's a brief interval where the application doesn't proactively invalidates the timed-out session before the Tomcat container invalidates it. To enable active
session timeout, the user also needs to define at least one of the following session timeout properties:  
{#sc-proactively-invalidate-inactive-sessions__table_ltm_tp1_nhc__entry__2}

| Property | Description |
|-|-|
| glide.ui.active.session.life_span | Defines the timeout period (in minutes) for UI sessions. |
| glide.guest.active.session.life_span | Defines the timeout period (in minutes) for guest sessions. |
| glide.integrations.active.session.life_span | Defines the timeout period (in minutes) for integration sessions. |
[ ]

{#sc-proactively-invalidate-inactive-sessions__table_ltm_tp1_nhc}

Ensure that the property glide.active.session.timeout.invalidate.session is set to true.

## More information {#sc-proactively-invalidate-inactive-sessions__section_qhx_1b1_xwb}

{#sc-proactively-invalidate-inactive-sessions__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * glide.active.session.timeout.invalidate.session * glide.ui.active.session.life_span * glide.guest.active.session.life_span * glide.integrations.active.session.life_span {#sc-proactively-invalidate-inactive-sessions__ul_or5_fq1_nhc} |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.6 * CVSS score: Medium * Security risk details: If a session is hijacked, an attacker may be able to use a session during this small period. {#sc-proactively-invalidate-inactive-sessions__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-proactively-invalidate-inactive-sessions__table_ajc_b43_3kb}