---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Restrict unauthenticated access to attachments
# Restrict unauthenticated access to attachments {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Restrict unauthenticated access to attachments
This feature in ServiceNow Brazil release enables administrators to restrict unauthenticated access to image attachments using the system propertyglide.imageprovider.securityenabled.
When enabled (true), only authenticated users can view image attachments, enhancing security by preventing unauthorized access to sensitive images via direct URLs.
Show full answer Show less
## Key Features
* **System Property Control:** Administrators can toggle unauthenticated access to images by setting **glide.imageprovider.securityenabled** to true or false.
* **Thumbnail Policy:** Thumbnails inherit the same access restrictions as their original attached images.
* **Fine-Grained Access Control:** Exceptions to the default restriction are managed through the **Security Allow/Deny List Entities \[syssecurityrestrictedlist\]** table and public Knowledge Base (KB) article declarations.
* **Exception Handling Order:**
* If the image's table or the thumbnail's parent table is deny-listed, access is denied.
* If allow-listed, access is granted.
* If included in a public KB article, access is granted.
## Key Outcomes
* Setting **glide.imageprovider.securityenabled** to true blocks unauthenticated users from accessing image attachments unless explicitly allowed, reducing risk of sensitive data leaks.
* If the property is not set, it defaults to false, meaning images are accessible to anyone with a URL.
* This property is critical for securing attachments and should be reviewed and configured properly alongside the allow/deny lists and KB article settings to balance security and accessibility.
* The security risk rating for leaving this property false is medium (CVSS 6.5), emphasizing the importance of enabling it to protect confidential information.
## Practical Steps for ServiceNow Customers
* Verify and set the **glide.imageprovider.securityenabled** property to true in the System Properties table to restrict unauthenticated access.
* Manage exceptions using the **syssecurityrestrictedlist** table to finely control which tables' images can be accessed unauthenticated.
* Declare public KB articles appropriately to allow access where necessary.
* Review existing attachments and access policies to ensure compliance with your organization's security requirements.
Restrict unauthenticated access to image attachments using a system property.
Use the glide.image_provider.security_enabled property restrict unauthenticated access to image attachments. If set to true, images are visible to any authenticated user but no
unauthenticated user. If set to false, images are visible to anyone with a URL to the attachment. Thumbnails of an attached image maintain the same policy as the original attached image and are accessible
to the same set of users as the original attached image. When this property is enabled, more fine grained access control for unauthenticated users is obtained through entries in the Security Allow/Deny List Entities
\[sys_security_restricted_list\] table and through the declaration of public KB articles for those images attached to KB articles. These exceptions to the default policy for unauthenticated users when this property is
true are applied in the following order.
Note:
In these exceptions, "parent table" refers to the table of the original image attachment from which a thumbnail is generated.
1. If the table of an attached image or parent table of a thumbnail image is deny-listed in the Security Allow/Deny List Entities \[sys_security_restricted_list\] table, access is denied to the image/thumbnail.
2. If the table of an attached image or parent table of a thumbnail image is allow-listed in the Security Allow/Deny List Entities \[sys_security_restricted_list\] table, access is granted to the image/thumbnail.
3. If the table of an attached image or parent table of a thumbnail image is included in a public KB article, access is granted to the image/thumbnail.
{#sc-restrict-unauthenticated-access-attachments__ol_dcd_yzm_yhc}
Ensure that the property glide.image_provider.security_enabled is set to true. If the property does not exist on the System Properties \[sys_properties\] table, the default value is
false.
## More information {#sc-restrict-unauthenticated-access-attachments__section_more_information}
{#sc-restrict-unauthenticated-access-attachments__table_ajc_b43_3kb__entry__2}
| Attribute | Description |
|-|-|
| Property name | glide.image_provider.security_enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Functional impact | If the property was previously false and then is set to true, unauthenticated users can no longer be able to access image attachments unless explicitly allowed using one of the exclusion procedures. |
| Security risk | * Severity Score: 6.5 * CVSS Rating: Medium * Security Risk Details: If the property is set to false, image attachments are visible to anyone authenticated or unauthenticated with a URL to the attachment. This may lead to sensitive information leaks. To avoid these, set the property to true and ensure any exceptions to the default policy when the property is true are properly configured. {#sc-restrict-unauthenticated-access-attachments__ul_nvy_fhs_mfc} |
| References | [Administering attachments](https://www.servicenow.com/docs/access?context=r_AdministeringAttachments&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US) [Available system properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US) |
[ ]
{#sc-restrict-unauthenticated-access-attachments__table_ajc_b43_3kb}
To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US).