---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Rotate HTTP session identifiers

# Rotate HTTP session identifiers {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.rotate_sessions property to enable rotation of
the HTTP session identifiers to reduce security vulnerabilities.
If the glide.ui.rotate_sessions system property is not set to the recommended value of true, then identifying information on a session is kept and not rotated between applications.

Ensure that the property glide.ui.rotate_sessions is set to true.

## More information {#sc-rotate-http-session-identifiers__section_wc1_cqn_phc}

{#sc-rotate-http-session-identifiers__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.rotate_sessions |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 8.8 * CVSS rating: High * Security risk details: Not setting glide.ui.rotate_sessions system property to the recommended value of true increases the risk of session hijacking, as attackers could reuse session identifiers to gain unauthorized access. {#sc-rotate-http-session-identifiers__ul_g1g_3sf_xwb} |
| Functional impact | This remediation modified the SessionID when user navigates from unauthenticated page to authenticated pages. * If you are using a proxy or hardcoding the SessionID when a user first logs in, or for any purpose, then there can be a potential functionality impact. * If you are using the SAML 2.0 plugin for Single Sign-on authentication, it might interfere with the session information sharing between the instance and the Identity Provider. In such case, you can set this property to false. {#sc-rotate-http-session-identifiers__ul_crx_n51_p3c} |
| Dependencies and prerequisites | None |
[ ]

{#sc-rotate-http-session-identifiers__table_ajc_b43_3kb}