---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Require JWT trust verification for guest embedded sessions

# Require JWT trust verification for guest embedded sessions {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.embedded.session.trust.verification.enabled property determines whether guest embeddable sessions require JSON Web Tokens (JWT) validation for third-party origin verification.
This property requires JWT validation to confirm that guest embeddable session requests come from trusted third-party websites.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Verify glide.embedded.session.trust.verification.enabled exists and is set to true.
{#sc-require-jwt-trust-verification-for-guest-embedded-sessions__ol_verification_steps}

## More information {#sc-require-jwt-trust-verification-for-guest-embedded-sessions__section_tp5_xfk_2kc}

{#sc-require-jwt-trust-verification-for-guest-embedded-sessions__table_ajc_y23_3ik__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.embedded.session.trust.verification.enabled |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 5.3 * CVSS rating: Medium * Security risk details: When this property is inactive, the platform establishes guest embedded sessions for Web embeddables components without JWT verification. The JWT is designed to confirm that requests originate from trusted third party websites. {#sc-require-jwt-trust-verification-for-guest-embedded-sessions__ul_g1g_3sf_xwb} |
| Functional impact | When enabled, any third-party website embedding guest components must implement the JWT-based token callback in its global code. See the [Web embeddables](https://www.servicenow.com/docs/r/customer-relationship-management/crm-web-embeddables.html) guest user documentation for more details. Sites that follow the documented setup are unaffected. JWT verification is the default behavior for this feature. Sites relying on the undocumented fallback behavior (proceeding without a token) must implement the callback before its embedded guest sessions can be established once enforcement begins. |
| Dependencies and prerequisites | Only applicable when the web components for guest embeddables (com.sn_guest_components) plugin is active. This property has no effect, and this control does not evaluate it, on instances where the plugin is not installed and active. |
[ ]

{#sc-require-jwt-trust-verification-for-guest-embedded-sessions__table_ajc_y23_3ik}