---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Require authorization for SOAP requests

# Require authorization for SOAP requests {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.
The glide.basicauth.required.soap property controls whether basic authentication is required to make a Simple Object Access Protocol (SOAP) request to an instance. If the
glide.basicauth.required.soap property is not set to true, unauthenticated users performing SOAP operations are mapped to the soap.guest user.

This may enable an unauthenticated user to perform operations on the instance as if a logged in user to the instance. There may be additional impact if the user define within com.glide.soap.guest_user is
assigned additional roles. The property glide.soap.require_ws_security (default false) controls whether WS-Security header validation is mandatory. When set to false, requests without
WS-Security are allowed if other auth mechanisms (basic auth, session) are present.

When set to false, both properties allow unauthenticated SOAP requests to map to the guest user and execute without credential validation, enabling unauthorized data export and system operations.

Ensure the glide.basicauth.required.soap property exists and is set to true. Alternatively, configure the instance for Web Services (WS) Security by setting the
glide.soap.require_ws_security property to true and following the product documentation to configure WS security profiles. If the property doesn't exist in the sys_properties table,
add it to the table.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-soap-request-authorization__section_wc1_cqn_phc}

{#sc-soap-request-authorization__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * glide.basicauth.required.soap * glide.soap.require_ws_security {#sc-soap-request-authorization__ul_xsf_cmh_p3c} |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | * false * false {#sc-soap-request-authorization__ul_mnd_hmh_p3c} |
| Default value | * true * false {#sc-soap-request-authorization__ul_default_values} |
| Fallback value | * true * false {#sc-soap-request-authorization__ul_qnb_3mh_p3c} |
| Category | [API and web service](https://www.servicenow.com/docs/8tbkriHSZwhTDBI3AxKzzQ "The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.") |
| Security risk | * Severity score: 8.1 * CVSS rating: High * Security risk details: When set to false, both properties allow unauthenticated SOAP requests to map to the guest user and execute without credential validation, enabling unauthorized data export and system operations. {#sc-soap-request-authorization__ul_g1g_3sf_xwb} |
| Functional impact | Disabling either property relaxes SOAP request authentication requirements. Basic authentication is optional or WS-Security validation is optional, allowing unauthenticated or weakly-authenticated requests to proceed. |
| Dependencies and prerequisites | None |
[ ]

{#sc-soap-request-authorization__table_ajc_b43_3kb}