---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Minimize session activity timeout duration

# Minimize session activity timeout duration {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.session_timeout property to set the session activity timeout duration in minutes.
The glide.ui.session_timeout property controls the inactive session timeout for authenticated users, specified in minutes. If this property is not set to the recommended value of 30 minutes or less, the session may remain valid for extended periods without user activity.

A long session timeout allows inactive sessions to remain valid for extended periods, increasing the chance that an attacker could hijack the session before it expires.  
To configure the glide.ui.session_timeout property:

1. Navigate to /sys_properties_list.do on the instance.
2. Confirm the glide.ui.session_timeout property doesn't exist in the sys_properties table or is set to 30 minutes or less.
{#sc-session-activity-timeout__ol_remediation_steps}

## More information {#sc-session-activity-timeout__section_wc1_cqn_phc}

{#sc-session-activity-timeout__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.session_timeout |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | 30 or less |
| Default value | 30 |
| Fallback value | 30 |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 7.5 * CVSS rating: High * Security risk details: A long session timeout allows inactive sessions to remain valid for extended periods, increasing the chance that an attacker could hijack the session before it expires. {#sc-session-activity-timeout__ul_g1g_3sf_xwb} |
| Functional impact | Reducing the glide.ui.session_timeout property lowers the amount of idle time allowed before a user's session ends automatically, requiring re-authentication. Users who leave a session idle longer than the configured value (for example, while completing a long form, waiting on an approval, or stepping away between tasks) will be logged out and must sign in again. Administrators should verify that long-running interactive workflows still complete comfortably within the new timeout window. They should also confirm that any automation or integration currently relying on a long-lived interactive UI sessions is migrated to a dedicated authentication method. Use OAuth or a service account rather than depending on session longevity. |
| Dependencies and prerequisites | The glide.ui.session_timeout property is capped by the static property glide.ui.max_session_timeout, which limits the maximum effective value to 1440 minutes. |
[ ]

{#sc-session-activity-timeout__table_ajc_b43_3kb}