---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Validate SOAP content type

# Validate SOAP content type {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.soap.require_content_type_xml property to enable validation of a content type as text/xml and protect against invalid SOAP requests.
If the glide.soap.require_content_type_xml system property is not set to the recommended value of true, then there is no validation for the SOAP request.

Ensure that the property glide.soap.require_content_type_xml is set to true.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-soap-content-type-checking__section_wc1_cqn_phc}

{#sc-soap-content-type-checking__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.soap.require_content_type_xml |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [API and web service](https://www.servicenow.com/docs/8tbkriHSZwhTDBI3AxKzzQ "The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.") |
| Security risk | * Severity score: 8.8 * CVSS rating: High * Security risk details: This lack of validation can enable Cross-Site Request Forgery (CSRF) attacks, allowing malicious actors to trick authenticated users into sending unauthorized SOAP requests. {#sc-soap-content-type-checking__ul_g1g_3sf_xwb} |
| Functional impact | This remediation enables validation of SOAP content type for all the inbound SOAP requests. * If you are using a content type other than text/xml for inbound requests, it may cause potential failure of SOAP transactions. * If you are not using the correct MIME type, it could disrupt third-party integrations. {#sc-soap-content-type-checking__ul_dk4_tfh_p3c} |
| Dependencies and prerequisites | None |
[ ]

{#sc-soap-content-type-checking__table_ajc_b43_3kb}