--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Baseline version 9.0 # Updated hardening settings for baseline version 9.0 {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 26 minutes to read Some hardening settings have been updated with the release of Security Center baseline version 9.0. {#updated-hardening-settings-for-baseline-version-nine__table_baseline_v8_changes__entry__2} | Documentation | Updates | |-|-| | [Disable AJAXEvaluate](https://www.servicenow.com/docs/aaJBpfzlGmbG6EOO_l0Odg "Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_0_description} | | [Enforce field-level ACLs on records created from the filtered list view UI query string](https://www.servicenow.com/docs/74a1GyfIhaJs9tc0ZZvGSA "Use a system property to prevent list filters from affecting the initial values of created records.") | * Short description * (Old) Enforce field-level ACLs on records created from the query string of the Filtered List view UI of a table * (New) Enforce field ACLs on records created from Filtered List view UI query string {#updated-hardening-settings-for-baseline-version-nine__ul_2e_short_description} * Functional impact * OldWhen com.glide.acl_check_all_filter_on_new is set to true, then ACLs may prevent fields included in the filter query string from affecting the value of fields in a created record when the creation is triggered from the list view UI of a table. However, this previous behavior was incorrect as it bypassed ACLs and allowed user without creation access to a field to modify its value. * NewWhen the com.glide.acl_check_all_filter_on_new is set to true, ACLs are enforced for fields included in the filter query string during record creation from the list view UI. This prevents users without create access from modifying protected fields through filter parameters. {#updated-hardening-settings-for-baseline-version-nine__ul_asn_5zx_gkc} {#updated-hardening-settings-for-baseline-version-nine__ul_5_main} | | [Escape XML markup](https://www.servicenow.com/docs/La2pu6owjlN_S8Tuepp6LA "Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client's browser.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_11_ooo} | | [Turn off verbose SQL error messages for import processor](https://www.servicenow.com/docs/J8ip4ebSqfthz6pdRNy4DA "Configure this property to control whether verbose SQL error messages are displayed.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_smb_zcy_gkc} | | [Require authorization for excel requests](https://www.servicenow.com/docs/61xKIITI3nYqI7LchJbj8Q "Use the glide.basicauth.required.excel property to designate if incoming Excel requests should require basic authentication.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_smb_zcy_hkv} | | [Enable protected tables plugin](https://www.servicenow.com/docs/eAJlkJ5DstyVlU33V2T~Xg "Use the com.glide.security.protected_table.enabled property to prevent higher privilege users from tampering with log tables.") | * Remediation * (Old) Set the Glide Property com.glide.security.protected_table.enabled to true. This requires a user with the security_admin role. * (New)Enable table protection through the guided activation flow: 1. Navigate to the Protected Tables plugin's guided activation flow. 2. Complete the activation process to enable table protection. Only users with the security_admin role can activate this control. {#updated-hardening-settings-for-baseline-version-nine__ol_yjy_xgy_gkc} Important: Don't enable this control by directly editing the property com.glide.security.protected_table.enabled outside that guided activation flow. Default protected tables: syslog, syslog_transaction, sys_outbound_http_log, sysevent, sys_audit, sys_push_notification, protected_table_configuration, syslog_app_scope To extend protection to additional tables, configure insert, update, and delete protection rules for each additional table and operation in the Protected Table Configuration list. {#updated-hardening-settings-for-baseline-version-nine__ul_umb_vby_hkv} * Security risk * OldLog integrity must be maintained to allow discovery of malicious activity. * NewWhen disabled (the default), Protected Tables protections don't apply, allowing maintenance-role users to modify or delete critical audit and security logs without detection. An attacker with maintenance credentials could tamper with syslog, sys_audit, and sysevent entries to cover malicious activity and evade forensic investigation. Disabling this property compromises the audit trail needed to detect and investigate security incidents. {#updated-hardening-settings-for-baseline-version-nine__ul_lpw_qhy_gkc} * Functional impact * Old \ * NewEnabling the com.glide.security.protected_table.enabled property causes create, update, and delete attempts on tables in the Protected Table Configuration list to be evaluated. Depending on that table's configured protection level, the attempt is blocked, logged, or ignored. The level shipped per table is not fixed. It depends on how long the Protected Tables plugin has been installed, so confirm the actual values on your instance rather than assuming a table is blocking. One exception holds everywhere: insert attempts on sysevent are never blocked or logged, since normal processing inserts sysevent records continuously. A refused attempt shows the message "Modifications to \ have been refused due to the Protected Table configuration. Please contact your system administrator." Any integration or business rule currently writing to or deleting from a blocking table will start failing once this property is enabled. {#updated-hardening-settings-for-baseline-version-nine__ul_lpw_jhi_gkc} * Default value * Old \ * New false {#updated-hardening-settings-for-baseline-version-nine__ul_krm_43y_gkc} {#updated-hardening-settings-for-baseline-version-nine__ul_myq_3hy_gkc} | | [Enable Jelly JS interpolation protection](https://www.servicenow.com/docs/ai1JKRlI7Z7Y25YrwbU05w "Use the glide.ui.jelly.js_interpolation.protect property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.") | * Functional impact * Old \ * NewEnabling this property causes the platform to reject Jelly JavaScript expressions that aren't explicitly recognized as safe or marked as SAFE. Instance owners should test custom UI pages, macros, and portal widgets that use Jelly-interpolated JavaScript expressions after making this change, and confirm that legitimate expressions continue to render as expected. Custom Jelly content that relies on dynamic, unmarked expressions may need to be updated to use the SAFE designation to continue functioning. {#updated-hardening-settings-for-baseline-version-nine__ul_ljw_jhi_gkc} * Default value * Old \ * New true in Australia and newer, false prior {#updated-hardening-settings-for-baseline-version-nine__ul_urm_43y_gkc} * Fallback value * Old false * Newtrue in Australia and newer, false prior {#updated-hardening-settings-for-baseline-version-nine__ul_kpw_qhy_gkc} {#updated-hardening-settings-for-baseline-version-nine__ul_iyq_3hy_gkc} | | [Restrict permissions for CMDB model](https://www.servicenow.com/docs/S_Mbl1j9Xo71E_H7v_Kfmg "Use the csm_cmdb_model.customer_visible_flag system property to limit customer access to data in the Product Models table as an additional access control to the CMDB model.") | Default value * (Old) \ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_ymb_zcy_hkv} | | ../reference/sc-disable-chat-server-debugging.html | Default value * (Old) \ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_yib_zcy_hkv} | | [Escape scripts in scratchpad](https://www.servicenow.com/docs/zk3rr26UKKV39yn3W0xk_g "Learn how scratchpad factors into the security posture of your instance and how to manage it so that malicious scripts can't be executed on it.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_iib_ncy_hkv} | | [Disable locked form elements debugging](https://www.servicenow.com/docs/9ZwZDprff_mVjsL0RrOWVg "Use a system property to prevent the display of explanation of locked form elements.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_iib_njy_hkv} | | [Configure service portal widgets table allow list](https://www.servicenow.com/docs/SqU75QxiXHP7Mo8NkKH~_Q "Learn how the glide.service_portal.widget.table_allow_list property enhances security by listing tables accessible to unauthenticated users through Service Portal widgets, dependent on additional checks and specific glide property settings.") | Default value * (Old) \ * (New)'' (empty string) {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1002_default} | | [Minimize session activity timeout duration](https://www.servicenow.com/docs/~l3yHAidqwMlLdlxR5O0Cw "Use the glide.ui.session_timeout property to set the session activity timeout duration in minutes.") | * Description * (Old)This property determines the user session timeout. This determines how long a user session stays active. If glide.ui.session_timeout is not set to the recommended value of "60" minutes or less, then the session may stay valid for long even without activity. This could provide too large of a time window to enable session hijacking attacks. * (New)The glide.ui.session_timeout property controls the inactive session timeout for authenticated users, specified in minutes. If this property is not set to the recommended value of 30 minutes or less, the session may remain valid for extended periods without user activity. A long session timeout allows inactive sessions to remain valid for extended periods, increasing the chance that an attacker could hijack the session before it expires. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_description} * Remediation * (Old)Ensure the property glide.ui.session_timeout is set to 60 or less. * (New)1. Navigate to /sys_properties_list.do on the instance. 2. Ensure the glide.ui.session_timeout property does not exist in the sys_properties table or is set to 30 minutes or less. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_remediation} * Functional impact * (Old) \ * (New)Reducing the glide.ui.session_timeout property lowers the amount of idle time allowed before a user's session ends automatically, requiring re-authentication. Users who leave a session idle longer than the configured value (for example, while completing a long form, waiting on an approval, or stepping away between tasks) will be logged out and must sign in again. Administrators should verify that long-running interactive workflows still complete comfortably within the new timeout window. Confirm that any automation or integration currently relying on a long-lived interactive UI session is migrated to a dedicated authentication method such as OAuth or a service account. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_functional} * Dependencies and prerequisites * (Old) \ * (New)The glide.ui.session_timeout property is capped by the static property glide.ui.max_session_timeout, which limits the maximum effective value to 1440 minutes. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_dependencies} * Data type * (Old) \ * (New)integer {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_datatype} * Default value * (Old) \ * (New)30 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0000147_main} | | [Set automatic token cleanup for token credentials](https://www.servicenow.com/docs/j11HDo29UDtmDqcLGlANCg "Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.") | Default value * (Old) \ * (New)true, 7 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1035_default} | | [Prevent impersonating user from viewing application data](https://www.servicenow.com/docs/mPhCbGaatfKfdvQHxCbdAw "Use system properties to prevent an impersonating user from viewing application data.") | Plugin applicability * (Old) \ * (New)sn_opp_market, sn_jny, sn_imt_vaccine, sn_imt_health_test, sn_hr_core, sn_egd_goals, sn_egd_core, sn_egd_act, sn_em, sn_talent_aia, sn_ecn {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1264_plugin} | | [Require authorization for JSONv2 request](https://www.servicenow.com/docs/7TINaAAOPUwtaIWeouYJNA "Use the glide.basicauth.required.jsonv2 property to designate if incoming JSONv2 requests should require basic authorization.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0060_default} | | [Implement the x-frame-options: SAMEORIGIN security header](https://www.servicenow.com/docs/8KzF0XGEaswS51he5cfROA "Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0025_default} | | [Maximize reset password SMS complexity](https://www.servicenow.com/docs/pncTItJp5Ev_qwHo6MIsEA "The password_reset.sms.default_complexity property controls the minimum required SMS code verification size required during password reset.") | Default value * (Old) \ * (New)6 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0173_default} | | [Limit integrations' active session life span](https://www.servicenow.com/docs/tLc1cbCxthpB88zR0SmpOQ "Use the glide.integrations.active.session.life_span property to enforce the maximum lifespan on active integration HTTP sessions, regardless of session inactivity.") | * Description * (Old)This configuration will enforce max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes and the value of zero will disable timing out the active sessions. A larger maximum lifespan could allow an attacker to persist in a stolen session for longer, increasing the scope of a security incident. This particular property is limited to integrations that have low-privilege access to an instance. * (New)The glide.integrations.active.session.life_span property enforces the maximum lifespan on active integration HTTP sessions, regardless of session inactivity. The configured value is in minutes. A value of zero disables the lifespan limit entirely, allowing sessions to persist indefinitely until the inactive timeout fires. This particular property is limited to integrations that have low-privilege access to an instance. A larger maximum lifespan allows an attacker to persist a stolen session for longer, increasing the scope of a security incident. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0895_description} * Remediation * (Old)Set the Glide Property 'glide.integrations.active.session.life_span' to a value greater than 0 and less than or equal to 720. * (New)1. Navigate to /sys_properties_list.do on the instance. 2. Ensure the glide.integrations.active.session.life_span property exists and is set to a value greater than 0 and less than or equal to 720 minutes. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0895_remediation} * Functional impact * (Old) \ * (New)Integration sessions that exceed the configured lifespan are silently invalidated and reissued a new session ID. The integration user sees no error, but any session-scoped state accumulated during that session is lost and starts fresh. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0895_functional} * Dependencies and prerequisites * (Old) \ * (New)This control interacts with the glide.integration.session_timeout property, which controls the integration idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the integration idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0895_dependencies} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0895_main} | | [Limit concurrent sessions across all nodes](https://www.servicenow.com/docs/ZYEfESF_mfPorQqqrtN6Ag "Use the glide.authenticate.limit.concurrent.sessions.across.all.nodes property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes.") | Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0425_default} | | [Minimize reset password SMS expiry duration](https://www.servicenow.com/docs/bCnVRm81fBYoLH2qkWNQ9A "Control the number of minutes remaining before the SMS code expires.") | Default value * (Old) \ * (New)5 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0174_default} | | [Double check inbound transactions](https://www.servicenow.com/docs/sw4bXt4jquMRdtAjGBOKPg "Use the glide.security.strict.updates property to enable double-checking of security on inbound transactions during form submission. When you set this property to true, it adds an extra layer of table validation before a form renders in the browser.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0008_fallback} | | [Disable soap fault stack trace display](https://www.servicenow.com/docs/pnIB~0~WbuPySuZ~9bBqsQ "Manage how stack traces are displayed in your instance.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0125_fallback} | | [Limit Invalid Password Reset Attempts](https://www.servicenow.com/docs/rt4gQltTA8sEcNNbujsldw "The password_reset.request.max_attempt is used to control the maximum number of unsuccessful attempts that a user can reset or change their password before being locked out for a specified period of time.") | Default value * (Old)\ * (New)3 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0168_default} | | [Anti-CSRF token validation time](https://www.servicenow.com/docs/QkQCoMk7tCcB5xzcRtcJ_A "The glide.security.csrf_previous.time_limit property specifies the time in seconds for a secure token to expire.") | Default value * (Old)\ * (New)86400 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0675_default} | | [Require CAPTCHA for guest walk-up experience in customer service application](https://www.servicenow.com/docs/TXNfScvW9ZXV5e1T5~EfkQ "The CAPTCHA for the Guest Walk-up experience prevents unauthenticated guest users to create bookings by requiring users to complete a CAPTCHA verification.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0663_default} | | [Require authorization for csv requests](https://www.servicenow.com/docs/NlJiMszf88yqJRi~w2_Gzw "Use the glide.basicauth.required.csv property to designate if incoming CSV (Comma-Separated Values) requests should require basic authentication.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0056_default} | | [Enable Identity and Access Audit tool](https://www.servicenow.com/docs/os_X2rnxlss2SaZ~T4hO2A "Use Identity and Access Audit to track changes to user accounts, groups, and roles.") | Configuration name * (Old)glide.identity.security.audit.enabled * (New)glide.identity.security.audit.enabled, com.glide.security.audit {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1369_config} | | [Disable public access to favorites](https://www.servicenow.com/docs/BC6ea3EcdfWfW2MQU4GRtQ "Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0299_default} | | [Proactively invalidate sessions after defined durations](https://www.servicenow.com/docs/as9g6ufH_gkhY5wStTI7Mw "The glide.active.session.timeout.invalidate.session property controls whether a timed-out session is proactively invalidated before the Tomcat server processes it.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0818_default} | | [Escape JavaScript \[Updated in Security Center 1.3\]](pcE~yuQaWUqYMKWyIxohkw "Use the glide.html.escape_script property to force escape from JavaScript () tags in HTML fields during list views.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0003_default} | | [Enable HTTP Only Cookie Flag](https://www.servicenow.com/docs/DfOuBThbHSF7cta~9Jpp8g "Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0023_default} | | [Enforce SOAP request strict security](https://www.servicenow.com/docs/UxVYI1KIv8NoUxKJr_r5cw "Use the glide.soap.strict_security property to enforces web service security.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0124_default} | | [Block rooted or jailbroken mobile devices](https://www.servicenow.com/docs/DhQRJk5eXbPE~mjYeYxXeA "Secure your instance by preventing unauthorized access from jailbroken devices.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0390_default} | | [Enforce strict elevate privilege](https://www.servicenow.com/docs/ZkmW43fyZHk0CLYCh~Ij9g "Use the glide.security.strict_elevate_privilege property to control whether roles marked as privileged must be manually elevated for the user to be granted the role's capabilities.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0669_default} | | [Enable the hardened java security manager](https://www.servicenow.com/docs/Yb48YvEw1UuFX7xylgS0WA "The glide.security.manager property contains the Java classname of the current Java security manager.") | Default value * (Old)\ * (New)com.glide.sys.security.ContextualSecurityManager {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0053_default} | | [Disable legacy JQuery behavior](https://www.servicenow.com/docs/fhFC936qVgYzJ2RT7TdufA "The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0079_default} | | [Enable account recovery](https://www.servicenow.com/docs/QrcqN_iZrYFQL5WlIsL8kA "Use the glide.sso.acr.enabled property to manage the account recovery feature.") | * Description * (Old)This property controls the account recovery feature, which binds the ability to bypass single sign-on to specifically designated administrators. If "glide.sso.acr.enabled" is not set to the recommended value of "true", then the local interactive log-ins (username or password based) will be remain enabled when single sign-on is enabled on the instance. * (New)The glide.sso.acr.enabled property controls whether the Account Recovery (ACR) feature is available on an instance configured for Single Sign-On (SSO) authentication. When set to the recommended value of "true", the platform blocks turning on multi-SSO until account recovery is enabled. At least one user account must be enrolled for it. It also confines any session authenticated through the recovery path to writing only SSO- and account-recovery-related configuration. This preserves a controlled, auditable path back into the system for users who lose access to their normal SSO credentials. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0260_description} * Security risk * (Old)Eliminating local interactive log-ins reduces the potential for unauthorized access to the instance. * (New)Without an account recovery path, a user who loses access to their normal sign-in method has no supported way back into the system. That gap commonly pushes administrators and help desks toward manual, ad hoc identity verification workarounds to restore access. Those workarounds are a well-known target for social engineering and account takeover because they bypass the organization's standard authentication controls. Leaving a recovery path unavailable increases the risk of unauthorized account access and loss of control over who can regain entry to affected accounts. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0260_security} * Functional impact * (Old) \ * (New)Enabling this control doesn't disable SSO. It requires that an account-recovery path exist and restricts write access on a recovery-authenticated session to SSO- and recovery-related properties only. Admin users that have never configured account recovery, or that have zero users enrolled, will be blocked from turning on Multi-SSO until at least one user opts in. Users may test the Multi-SSO activation flow and the account-recovery login flow when removing or disabling ACR-enrolled users. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0260_functional} * Data type * (Old) \ * (New)Boolean {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0260_datatype} * Default value * (Old) \ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0260_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0260_main} | | [Enforce strict user image upload](https://www.servicenow.com/docs/eQGFUUEczpCg04zA34jEow "Use the glide.security.strict.user_image_upload property to enable access control for the upload/update of a profile picture when performed on a user record.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0258_oob} | | [Verify certificate chain and hostname](https://www.servicenow.com/docs/i~dNbjhf_v~WqqZv9ClPtA "Configure the com.glide.communications.httpclient.verify_hostname property to prevent man-in-the-middle-attacks by ensuring that the certification verification process is executed.") | * Functional impact * (Old) \ * (New)When the com.glide.communications.httpclient.verify_hostname property is set to true, an outbound HTTPS connection is rejected if the remote host's certificate doesn't match the requested hostname or its certificate chain can't be validated. Outbound integrations to hosts with a mismatched or misconfigured certificate will fail to connect once this property is set to true. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0677_functional} * Dependencies and prerequisites * (Old) \ * (New)The "com.glide.communications.httpclient.verify_hostname" property governs hostname and certificate chain validation independently of the "com.glide.communications.httpclient.verify_revoked_certificate" property, the overall gate for certificate revocation checking. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0677_dependencies} * Data type * (Old) \ * (New)Boolean {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0677_datatype} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0677_main} | | [Minimize session window timeout duration](https://www.servicenow.com/docs/g0Gy3Nd2OtT~Qv_ReYgaHg "Use the glide.ui.user_cookie.life_span_in_days property to set the expiration time period for the Remember Me cookie. The default value is 15 days and the maximum cap is at 30 days.") | Default value * (Old) \ * (New) 15 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0153_oob} | | [Maximize reset password verification delay duration](https://www.servicenow.com/docs/DNmkFnxwH_qWbYKTUfBIiw "Configure the delay, in milliseconds, that a user must wait before submitting a new password reset request.") | Default value * (Old) \ * (New) 1000 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0177_oob} | | [Log session audit events](https://www.servicenow.com/docs/VpH0CHD8P4d3VnRFWhSVbA "Use a system property to enable creations of session audit events") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0801_oob} | | [Ensure archive table ACLs are checked](https://www.servicenow.com/docs/22l9SYX0Un6MNjyTXa256g "The glide.security.enable_archive_table_acls property controls whether access control lists (ACLs) of the original table, the table the archive table was created from, are evaluated to false.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0752_oob} | | [Enforce HTML sanitization](https://www.servicenow.com/docs/g4vlfj48pm7r2awtm~c9HA "Use the com.glide.security.check_unsanitized_html property to enforce sanitization behavior of translated_html fields on a global level for field assignments.") | Default value * (Old) \ * (New) enforce {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0223_oob} | | [Enable CAPTCHA for external user registration](https://www.servicenow.com/docs/uiT9GQRUl5vJ3vwe~v3AWg "The sn_ext_usr_reg.captchaEnabled controls if CAPTCHA will be validated for external user registration.") | * Rule Script: Script has been updated to improve detection accuracy * Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0185_oob} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0185_main} | | [Require AJAXGlideRecord ACL checking](https://www.servicenow.com/docs/9RWKhX~4Ovjw78E7RUx9Fg "Use the glide.script.secure.ajaxgliderecord property to perform access control rule (ACL) validation when server-side records, such as tables, are accessed using GlideAjax APIs within a client script.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0283_oob} | | [Require Minimum and Maximum Password Length](https://www.servicenow.com/docs/eFV_75PP3UrH0n92W~e6ng "Set minimum and maximum password lengths to avoid compliance issues and reduce the risk of a successful brute force attack") | Rule script: Script has been updated to improve detection accuracy. | | [Enable password reset policy checks](https://www.servicenow.com/docs/4~rxf1alWfXf9Sq9hvyk1A "Use the glide.enable.password_policy property to enable password policy checks whenever a user changes their password using the user interface.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0256_oob} | | [Enforce oauth state parameter validation](https://www.servicenow.com/docs/ZYE012BcQ5xUdYF5FTSi6g "Configure the glide.oauth.state.parameter.required property to prevent your instance from cross-site request forgery (CSRF) attacks.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0366_oob} | | [Restrict Global App Development by Role](https://www.servicenow.com/docs/q7DfnILpTUmVPlb~zCnybA "Use the sn_g_app_creator.allow_global property to control which users can create applications in the global scope using the Guided Application Creator.") | ODefault value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1070_oob} | | [Restrict knowledge bases access](https://www.servicenow.com/docs/vp_pBmTJWccMoLrqIgYTcg "The glide.knowman.block_access_with_no_user_criteria property is used to control the read/write access of users on knowledge based articles.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0087_oob} | | [Timeout guest sessions](https://www.servicenow.com/docs/677Q4ir1Q8yH0WN_riH0_A "Use a system property to control the inactive session timeout for unauthenticated users.") | * Description * (Old)Use the glide.guest.session_timeout system property to control the inactive session timeout for unauthenticated users. By default, the value of this property is 30 minutes. If there are availability concerns from persisting too many sessions in memory, the value of this property can be lowered to 5. Avoid setting this property greater than 30, as large timeout values increase the number of sessions persisted by the instance, and may cause minor availability concerns. Avoid setting this property greater than 30. Large timeout values increase the number of sessions persisted by the instance, and may cause minor availability concerns. * (New)The glide.guest.session_timeout property controls the inactive session timeout for unauthenticated (guest) users, specified in minutes. New instances are provisioned with a default of 5 minutes. If the property does not exist in the sys_properties table, the effective value defaults to 0. When set to 0, the guest-specific override is turned off and the session instead uses the general UI session timeout (glide.ui.session_timeout). Setting the glide.guest.session_timeout property greater than 30 minutes increases the number of sessions persisted by the instance, which may cause minor availability concerns. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1268_description} * Remediation * (Old)Ensure the Glide Property 'glide.guest.session_timeout' is configured to the default value of 30. In the rare case there are availability concerns from persisting too many sessions in memory, the value of this property can be lowerered to 5. * (New)1. Navigate to /sys_properties_list.do on the instance. 2. Ensure the glide.guest.session_timeout property exists and is set to a value greater than 0 and less than or equal to 30 minutes. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1268_remediation} * Dependencies and prerequisites * (Old) \ * (New)The glide.guest.session_timeout property interacts with the glide.ui.session_timeout property. When glide.guest.session_timeout is set to 0, guest sessions don't receive an independent idle timeout --- they fall back to using glide.ui.session_timeout instead. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1268_dependencies} * Default value * (Old)30 * (New)5 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1268_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1268_main} | | [Restrict flow context read access](https://www.servicenow.com/docs/4oEAVUWucD9mQmpsLWc~Dg "Use the com.snc.process_flow.reporting.require_flow_access property to enforce if an additional access check is required for a user to read a flow check.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0971_default} | | [Minimize external user registration link expiration duration](https://www.servicenow.com/docs/TjoTMphqs497HMJNlT5J~Q "Manage the number of days that a registration link can be accessed.") | * Rule Script: Script has been updated to improve detection accuracy * Default value * (Old) \ * (New) 3 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0186_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0186_main} | | [Require authorization for SCHEMA requests](https://www.servicenow.com/docs/rg6utQuz7VjGtZg3v3Gfzg "Use the glide.basicauth.required.schema property to require basic authorization for all Inbound Table Schema Processor requests.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0063_default} | | [Enable IAM and boundary checks for Amazon Bedrock access](https://www.servicenow.com/docs/U71acmj5xLuznZtRajd5Nw "Enable IAM and Boundary Checks for Amazon Bedrock access.") | Short description * (Old)Enable multiple (permission policy and boundary) checks to ensure that the Role is privileged in AWS/Bedrock * (New)Enable IAM and Boundary Checks for Amazon Bedrock access {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1463_shortdesc} | | [Enable UserCookie version 3.1](https://www.servicenow.com/docs/QS~ioYyMdp2R1fS0n6RazQ "Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0363_default} | | [Limit guest's active session life span](https://www.servicenow.com/docs/D_nC27wS3_Oad6BghSQnYQ "Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.") | * Description * (Old)This configuration will enforce max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes and the value of zero will disable timing out the active sessions. This particular property is limited to Guest users, which have low privilege access to an instance. * (New)The glide.guest.active.session.life_span property enforces a maximum lifespan on active guest HTTP sessions, regardless of the session activity. The configured value is in minutes. A value of zero disables the lifespan limit entirely, allowing sessions to persist indefinitely until the inactive timeout fires. Guest users are unauthenticated users who access the instance without logging in. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0820_description} * Rule script: Script has been updated to improve detection accuracy * Functional impact * (Old) \ * (New)Guest HTTP sessions that exceed the configured lifespan are silently invalidated and reissued a new session ID. The guest user sees no error or logout screen, but any session-scoped state (for example, in-progress form data, embedded portal widget context, or session-based rate limiting) accumulated during that session is lost and starts fresh. Legitimate guest users on long-running but otherwise idle browser tabs may need to reload the page after the configured interval elapses. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0820_functional} * Dependencies and prerequisites * (Old) \ * (New)This control interacts with the glide.guest.session_timeout property, which controls the guest idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0820_dependencies} * Data type * (Old) \ * (New)integer {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0820_datatype} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0820_main} | | [Configure service portal widgets allow list](https://www.servicenow.com/docs/~lluD1KFMmizBKhtVS4kCQ "Learn how to configure the glide.service_portal.widget.allow_list property securely so that the access control lists (ACLs) for the tables don't expose sensitive information.") | Default value * (Old) \ * (New) '' {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1000_oob} | | [Require authorization for XML output requests](https://www.servicenow.com/docs/G6o_OvHYL9uzMkL~oMiclQ "Configure this property so that basic authorization is required for all inbound XMLOutputProcessor requests.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0227_oob} | | [Enforce production instance behavior](https://www.servicenow.com/docs/5_6tZGaeTcKdWQcZhfK4tQ "Configure whether your instance should be handled like a production or non-production instance.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0031_oob} | | [Restrict HR case updates from personal emails](https://www.servicenow.com/docs/gQSx10pKmxJSzul0s0GRuw "Use the sn_hr_core.restrict_guest_email property to control whether a user can respond back to a HR case with their personal email.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0689_oob} | | [Restrict JSONP requests to trusted URLs](https://www.servicenow.com/docs/W7pN8UgWU_xlsnPO5U1oDg "Specify trusted URLs for the AngularJS $http service to allow or reject JSONP requests.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0273_oob} | | [Minimize reset password request success window duration](https://www.servicenow.com/docs/6yHSRnffTtaowUG6U6BVTw "The password_reset.request.success_window property controls the number of minutes a user must wait to reset or change their password again after successfully resetting the password. The user will be blocked to reset the password again for the specified duration.") | Default value * (Old) \ * (New) 1440 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0171_oob} | | [Activate role based multi-factor authentication](https://www.servicenow.com/docs/tBmXlynrLEbMB5V7Welc8Q "Use the glide.authenticate.multifactor property to enforce role-based multi-factor authentication (MFA) for all users assigned to specific roles.") | * Functional impact * (Old) \ * (New)Users assigned the admin, security_admin, or user_admin role will be prompted for a second authentication factor at login, and their password. Users without one of these roles are unaffected. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0269_functional} * Dependencies and prerequisites * (Old) \ * (New)For role-based MFA enforcement to take effect, glide.authenticate.multifactor must be set to "true" and multi_factor_criteria must be active. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0269_dependencies} * Default value * (Old) \ * (New)false,"The multi_factor_criteria table record with sys_id d427668b73003300fdbd04fbc4f6a7b6 is shipped in a zbooted instance but is not set to active" {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0269_oob} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0269_main} | | [Require authorization for RSS requests](https://www.servicenow.com/docs/u40zJH2Usj9JR4uEr6hDGg "Use the glide.basicauth.required.rss property to designate if incoming RSS requests should require basic authentication.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0062_oob} | | [Apply domain separation on dot walked fields](https://www.servicenow.com/docs/ZoHwgcvB5MzrhaPCD8QAYw "The glide.sys.domain.include_domain_condition_on_join property controls whether join queries are given domain separated conditions or not in order to ensure they apply domain separation functionality for dot walked fields.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0233_oob} | | [Disable logger for low privilege users in script sandbox](https://www.servicenow.com/docs/DHzeb9BrkwFqSqceTa1PUw "Manage Glide System's ability to log scripts being executed in the sandbox environment.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0479_oob} | | [Maximum allowed attachment size](https://www.servicenow.com/docs/v6fJpv4Yn0XUz13G1n2APg "Configure the com.glide.attachment.max_size property to control the maximum size (in megabytes) permitted for an uploaded attachment.") | Default value * (Old) \ * (New) 1024 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0524_oob} | | [Maximize reset password request unlock window duration](https://www.servicenow.com/docs/8GEyy5CUQH5zVDU~zzKhzw "The password_reset.request.unlock_window property controls the number of minutes a user must wait to start a reset request after the last successful unlock account action.") | Default value * (Old) \ * (New) 1440 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0172_oob} | | [Require authorization for PDF requests](https://www.servicenow.com/docs/mqk1GNsBn0o__~GoD_9lwQ "Use the glide.basicauth.required.pdf property to designate if incoming PDF requests should require basic authentication.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0061_oob} | | [Enable antivirus scan](https://www.servicenow.com/docs/saNCtYT03LhTtVVv2zlbYg "The com.glide.snap.enable_scan property activates the antivirus scan functionality.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0190_oob} | | [Prevent empty ACL creation](https://www.servicenow.com/docs/JmA3LpyVi04d62lvfL0BWA "Set the glide.security.empty_acl.popup_window.enabled property to the secure value of true to block attempts to create, update, or save an invalid ACL. This setting will also provide a client-side model to configure a role or security attribute for the ACL.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1072_oob} | | [Disable Multi-SSO debugging](https://www.servicenow.com/docs/cijga24sHx3_q4Q45PJ6KQ "The glide.authenticate.multisso.debug property controls debug logging for Multi-SSO.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0201_oob} | | [Escape Excel formulas](https://www.servicenow.com/docs/_gdf~98nC~UPb0qeDAcBxg "Use the glide.export.escape_formulas property to prevent Excel Injection, also, known as formula injection.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0259_oob} | | [Disable JavaScript tags in embedded HTML](https://www.servicenow.com/docs/5MCZrdRyK60jrGnKniPgKw "Use the glide.ui.security.codetag.allow_script property to disable support for embedding HTML JavaScript code created using of the [code] tag.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0224_oob} | | [Prevent usage of 3DES keys](https://www.servicenow.com/docs/DZVgl7V0cS5Saw4gDRBTbg "Disable the use of 3DES static keys on your instance with a system property.") | Dependencies \& prerequisites * (Old) \ * (New)The property glide.security.3des.removal_job_status acts as a readiness gate. The scheduled job walks through deactivating/rotating out old 3DES static keys, and that job reports its progress via this status property. Until that job reports it's done (KEYS_DEACTIVATED or RESUPPLIED), it's not yet possible to flip glide.security.3des.static_keys_usable to false, because doing so prematurely could break decryption of data still encrypted with those static keys. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1296_dependencies} | | [Restrict downloadable MIME types](https://www.servicenow.com/docs/18MTtIbYukPg5_rauDoiVg "The glide.ui.attachment.download_mime_types property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0294_oob} | | [Prevent inactive users from logging in](https://www.servicenow.com/docs/ePlLNe0DFy9z9fGYQTOejw "Configure this property to control if inactive users can authenticate on your instance.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0977_oob} | | [Enable HTML sanitizer within Virtual Agent](https://www.servicenow.com/docs/~gIQ_oAxdralziHFokLEIQ "Use the com.glide.cs.html.sanitizer.enabled property to enable HTML sanitizer service.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0028_oob} | | [Enable policy based session access for mobile](https://www.servicenow.com/docs/G0RBjz_OPMOmOOuhMjgFQw "Use the The Zero Trust- Policy Based Session Access plugin to control if users authenticating through a mobile app will have their roles reduced.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0975_oob} | | [Enable report view ACLs](https://www.servicenow.com/docs/NQrZ__PgMV~9uXtuTnH6yQ "Manage a check for report_view ACLs of published reports.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0029_oob} | | [Restricted Binding functionality in Case Bearer authorization](https://www.servicenow.com/docs/RPz7Uo5VVXNdK9XPPi~lcQ "Restricted Binding Functionality in Case Bearer Authorization") | * Rule script: Script has been updated to improve detection accuracy * Default value * (Old)false * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1295_oob} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1295_main} | | [Maximize reset password request retry window duration](https://www.servicenow.com/docs/zmBcnp1m~BeGj4AAagCz1A "The password_reset.request.retry_window property controls the number of minutes before the count for password reset attempts refreshes.") | Default value * (Old) \ * (New) 1440 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0170_default} | | [Deny by default with empty ACLs](https://www.servicenow.com/docs/f9IYeEaBjLh5uuURy04PxQ "Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing Access Control List (ACL) rules are a part of wildcard table ACL rules.") | Default value * (Old) \ * (New) deny {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0225_default} | | [Disable unauthenticated published reports](https://www.servicenow.com/docs/UjsTk231LgB~j_8_~hzWCg "Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0221_default} | | [Minimize SMTP Recipient Quantity](https://www.servicenow.com/docs/fMwdzoX3ZeUAxkLH2OIF_w "The glide.email.smtp.max_recipients specifies the maximum number of recipients the instance can list in the To: line for a single email notification.") | Default value * (Old) \ * (New) 100 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0247_default} | | [Clear pasteboard when app backgrounds](https://www.servicenow.com/docs/wIJzr4hjUq0Z5FNe2NZF0g "The glide.sg.clear_pasteboard_when_backgrounded property controls if text copied from ServiceNow mobile app is kept in the clipboard and pasteboard after the app is in background mode. If it is not set to the recommended value of true, then sensitive information may be disclosed to the Android or iOS clipboard where it can be exposed to other applications on the device.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0243_default} | | [Restrict uploaded MIME types](https://www.servicenow.com/docs/T_qE~wGznGmBpEc~oxHR8A "Use the glide.security.file.mime_type.validation property to activate MIME type checking for uploads. You can enable (set the property to true) or disable (set it to false) MIME type validation for file attachments.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0300_default} | | [Enable ACLs for Encoded Query in Simple List Widget](https://www.servicenow.com/docs/jXR8OY5cWu_XtoCXnn3fIQ "Learn how to set the glide.service_portal.enable_acls_for_encoded_query_in_list property to the secure value to prevent users from bypassing access control list (ACL) evaluations on a query condition in the Simple List Widget.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1083_default} | | [Require Authorization for XSD Requests](https://www.servicenow.com/docs/prhjmOoAInEnO_fosPy3HQ "Use the glide.basicauth.required.xsd property to designate if incoming XSD (XML Schema Definition) requests should require basic authentication.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0279_default} | | [Enable SMS code notification for enrollment and verification](https://www.servicenow.com/docs/ZBSKh9dfVxung4Eel5DDLg "The password_reset.sms.use_notify property controls the usage of SMS code notifications for password reset.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0431_default} | | [Use of secure insert multiple operation within import set API](https://www.servicenow.com/docs/Jy8PlMdEI5pP512Eia5~AQ "Use the com.glide.import_set_api.insert_multiple_optimize property to control whether GlideRecordSecure or GlideRecord is used for the Insert Multiple operation within the Import Set API.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0656_default} | | [Define restricted downloadable MIME types](https://www.servicenow.com/docs/kJU~fSO2CZxNErOMSPmaVA "Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.") | * Description * (Old) If glide.ui.attachment.download_mime_types does include dangerous MIME types such as text/html, image/svg ,image/svg+xml,application/xml, then dangerous files could be rendered inline in the browser, which could lead to Cross Site Scripting attacks (XSS). This property is the list of comma-separated attachment mime types, which won't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. Maintaining this list properly prevents cross-site scripting attacks. If the glide.ui.attachment.download_mime_types system property doesn't include dangerous MIME types such as "text/html, image/svg,image/svg+xml,application/xml", then dangerous files could be rendered inline in the browser. This can lead to Cross Site Scripting (XSS) attacks. This check is only relevant when glide.ui.attachment.force_download_all_mime_types is set to false. This property is a list of comma-separated attachment MIME types, which don't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. * (New) If the glide.ui.attachment.download_mime_types property doesn't include dangerous MIME types such as text/html, image/svg, image/svg+xml, application/xml, and application/xhtml+xml, then those dangerous files could be rendered inline in the browser, which could lead to Cross-Site Scripting (XSS) attacks. This property is a comma-separated list of attachment MIME types that are downloaded to the client and don't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. Maintaining this list properly by including all dangerous MIME types prevents Cross-Site Scripting attacks. Note: This property's protection is only relevant when the glide.ui.attachment.force_download_all_mime_types property is set to false. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0130_description} * Fallback value * (Old) text/html,image/svg,image/svg+xml,application/xml * (New) '' {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0130_fallback} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0130_main} | | [Verify certificate revocation](https://www.servicenow.com/docs/Q0C0t0Cp1lD~UHmARXQooQ "The com.glide.communications.httpclient.verify_revoked_certificate property checks certificate revocation during the Transport Layer Security (TLS) handshake to ensure that security checks aren't bypassed.") | * Functional impact * (Old) \ * (New) When the com.glide.communications.httpclient.verify_revoked_certificate is set to true, every outbound HTTP request over TLS has its certificate checked for revocation using OCSP or CRL, as governed by the other properties in this family. When this property is set to "false", no revocation checking is performed at all for outbound TLS connections, regardless of how the other certificate-revocation properties are configured. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0071_functional} * Data type * (Old) \ * (New) Boolean {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0071_datatype} * Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0071_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0071_main} | | [Honor admin override ACLs](https://www.servicenow.com/docs/Q~~k6Rv8SSFgb8wrP3Bi8Q "The glide.security.admin.override.accessterm property controls whether admins can control override access control list (ACL) evaluation.") | * Description * (Old) ACLs are evaluated cumulatively. If there are a number of ACLs on any given field and the Admin Overrides option is false (not selected) on one of them, then the effective admin overrides for all the ACLs are considered to be false. This causes admins to be unable to pass even the ACL where the override should be in effect. If "glide.security.admin.override.accessterm" is not set to the recommended value of "true" then, even if one of the ACL terms under the ACL rule is "Admin overrides" false, the entire rule evaluates to false. * (New) The "glide.security.admin.override.accessterm" property controls how the platform decides whether an administrator can bypass an access rule when a resource (a table, a field) has more than one access rule applied to it. Each individual access rule can be configured to grant or deny an admin override on its own. When this property is set to its recommended value of true, the per-rule setting is honored individually. A rule explicitly configured to deny an admin override still blocks the administrator even if another rule on the same resource permits one. When set to "false", the bypass decision is instead made at a broader, combined level. This can let an administrator through even though one of the applicable rules was specifically configured to block the override. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_description} * Security risk * (Old) ACLs with conflicting "Admin overrides" settings may cumulatively evaluate to false, potentially preventing administrators from accessing fields they should have access to and inadvertently causing denial of access to critical data. * (New) When access checks are evaluated coarsely, a privileged user can access a resource despite rules set to deny override. This allows the most restrictive protection to be ignored in favor of a more permissive rule on the same resource. Protected data can be set to readable or writable, risking unauthorized access to sensitive information. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_security} * Functional impact * (Old) \ * (New) Changing this property to true affects only elevated-admin access decisions on resources governed by more than one access rule; regular users and single-rule resources see no behavior change. After the change, test contextual security scenarios where an admin role is granted access to a field or record through multiple layered rules, confirming that a rule explicitly configured to deny override still blocks the admin as expected. No service availability impact is expected since the change only tightens an authorization decision path. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_functional} * Data type * (Old) \ * (New) Boolean {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_datatype} * Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_default} * Fallback value * (Old) true * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_fallback} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0100_main} | | [Set safe content security policy for SVG files](https://www.servicenow.com/docs/JBsscxriEDSwlv6az9bF4g "The com.glide.csp.self_script_src_svg property adds the script-src none directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics (SVGs) are accessed through the Translation Memory Index (IIX) file extension.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0767_default} | | [Check UI action conditions before execution](https://www.servicenow.com/docs/pYkDdfdD4TLtPD8JSLzI_A "Use the glide.security.strict.actions property to enable checking of UI actions conditions in forms and lists before they execute. When you set this property to true, it adds an extra layer of validation on the table UI actions before they are executed.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0115_default} | | [Disable inbound emails for locked out users](https://www.servicenow.com/docs/AEUHAJDGaihEs2MmxHDkkg "Use the glide.pop3.process_locked_out property to control inbound email actions for locked out, active users.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0245_default} | | [Rotate HTTP session identifiers](https://www.servicenow.com/docs/jQtHZoej3VQz0CS5pG9SYA "Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0142_default} | | [Escape jelly script](https://www.servicenow.com/docs/6MAowddmbC4SjfvZ2Yt7Yg "Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0010_default} | | [Set Xframe options to prevent embedding third-party websites](https://www.servicenow.com/docs/_b1MiXiaSzGSDnrRxuK6tQ "Configure this property to prevent the content of a web-application from being embedded in a third-party site.") | Default value * (Old) \ * (New) sameorigin {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0072_default} | | [Require authorization for WSDL request](https://www.servicenow.com/docs/37tm2~IbD4oLQC546bL3Ng "Use the glide.basicauth.required.wsdl property to designate if incoming WSDL (Web Services Description Language) requests should require basic authentication.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0066_default} | | [Minimize absolute session timeout duration](https://www.servicenow.com/docs/KI~U1sylVcIjFLss1tvd6g "Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance.") | Default value * (Old) \ * (New) 30 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0154_default} | | [Limit the policy-based mobile refresh token interval](https://www.servicenow.com/docs/brUHypwkEbQiQxa0Qg~8EA "Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate.") | Default value * (Old) \ * (New) 1800 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0972_default} | | [Control lockout time for invalid password reset attempts](https://www.servicenow.com/docs/sJZErm9RN6X6qexE6iRIHA "The password_reset.request.max_attempt_window property controls the number of minutes a user must wait to reset or change their password after exceeding the maximum number of unsuccessful attempts that is set with the password_reset.request.max_attempt property.") | Default value * (Old) \ * (New) 1440 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0169_default} | | [Limit max subscriptions per user per day](https://www.servicenow.com/docs/gaZwDahELUpANAiYTERj0Q "Configure the sn_kb_social_qa.max_subscriptions_per_user_daily property to limit the max number subscriptions a user can subscribe to in a day.") | Default value * (Old) \ * (New) 500 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0217_default} | | [Restrict access to emails with empty target table](https://www.servicenow.com/docs/NOmiynBvEaT~aN55QZxPsA "Activate the glide.email.email_with_no_target_visible_to_all property to restrict user access to emails, unless they were the one who sent the email or have an admin role.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0291_default} | | [Enable CAPTCHA in password reset](https://www.servicenow.com/docs/y3ZfipJugJcHn9Ok9yApaA "Use the password_reset.captcha.ignore property to enable or disable requiring a CAPTCHA challenge when a user resets their password.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0166_default} | | [Validate SOAP content type](https://www.servicenow.com/docs/q9FNSuYR7Pr0okeBCUINBg "Use the glide.soap.require_content_type_xml property to enable validation of a content type as text/xml and protect against invalid SOAP requests.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0122_default} | | [Disable secure cookie debugging](https://www.servicenow.com/docs/utESxOcYWYqsvdq5VYPTOA "Manage the log messages related to cookies in your instance.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0099_default} | | [Limit max comments per user per day](https://www.servicenow.com/docs/99t7zYVmiANTbO6hmFtNbw "Configure the sn_kb_social_qa.max_comments_per_user_daily property to restrict the number of QA comments per day.") | Default value * (Old) \ * (New) 500 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0215_default} | | [Validate remote host](https://www.servicenow.com/docs/RBkMIeYpv1JhE6lcZfLj0g "Set the property to true to prevent bad actors from using internal port scanning in your network.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0155_default} | | [Require authorization for data broker rest API](https://www.servicenow.com/docs/egurxEfZW0hP08VnSngZew "Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0626_default} | | [Require authorization for script requests](https://www.servicenow.com/docs/XDnXQjLDa4YBpoC63t8IQA "Use the glide.basicauth.required.scriptedprocessor property to designate if incoming script requests should require basic authentication.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0064_default} | | [Disallow infected file download](https://www.servicenow.com/docs/fHiF5GYzptJ59Gw777ooPg "Control whether users can download non-scanned attachments if the antivirus service is down or unreachable.") | * Functional impact * (Old) \ * (New)Users can download non-scanned attachments if the antivirus service is down or unreachable. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0191_functional} * Default value * (Old)true * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0191_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0191_main} | | [Require authentication by default for client-callable script includes](https://www.servicenow.com/docs/BPrKvgIkXGO2iiEYENR5zg "By default, client-callable script includes that do not explicitly set visibility, are public. If needed, add the glide.script.ccsi.ispublic property to enable privacy control over all client-callable script includes accessed by public pages.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0007_default} | | [Enforce relative links](https://www.servicenow.com/docs/RdXAJ8s~rHXa2UYTx5yPpg "Use the glide.cms.catalog_uri_relative property to enforce relative links from the URI parameter on /ess/catalog.do.") | Default value * (Old) \ * (New) true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0266_default} | | [Require obfuscation of mobile app UI](https://www.servicenow.com/docs/rsFl_nPBjlwb3kXTpjH7gw "Configure the glide.sg.blur_ui_when_backgrounded property so that the UI of the app is blurred when the app is running in the background.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0242_default} | | [Restrict access to GlideSystemUserSession scriptable API](https://www.servicenow.com/docs/nZGLu8MXZcw49BAmmX~Kfw "The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call this method via script.") | Default value * (Old) true * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0027_default} | | [Enable work order management query rules for service organizations](https://www.servicenow.com/docs/EMzE4OpqWZihKT6yMb7C9Q "Use the sn_fsm.use_query_rules property to apply rules and filters to the Field Service Management tables.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0953_default} | | [Enforce device encryption and passcode requirements \[New in Security Center 1.3\]](55t6VVKB~tvW5Vn~fW9Tbg "The glide.sg.device_encryption_enabled property enforces the Federal Information Processing Standard (FIPS 140-2) Encryption. Mobile device encryption and passcode ensure that an unauthorized user can't access the content of a device even if the device is physically obtained.") | Default value * (Old) \ * (New) false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0668_default} | | [Require authorization for SOAP requests](https://www.servicenow.com/docs/L7kMG~akOwjxqEQUNfNs_w "Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.") | * Technical Configuration Name * (Old)glide.basicauth.required.soap, glide.soap.require_ws_security * (New)glide.basicauth.required.soap,glide.soap.require_ws_security {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_config} * Rule script: Script has been updated to improve detection accuracy * Security risk * (Old)Unauthenticated access to SOAP export data, when combined with misconfigured guest user role, poses a significant risk of unauthorized data exposure. * (New)When set to false, both properties allow unauthenticated SOAP requests to map to the guest user and execute without credential validation, enabling unauthorized data export and system operations. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_security} * Functional impact * (Old) \ * (New)Disabling either property relaxes SOAP request authentication requirements. Basic auth and/or WS-Security validation is set to optional, allowing unauthenticated or weakly-authenticated SOAP requests to proceed. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_functional} * Data tyype * (Old) \ * (New)Boolean {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_datatype} * Default value * (Old) \ * (New)true,false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_default} * Fallback value * (Old)true,true * (New)true,false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_fallback} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0002_main} | | [Enforce application specific ACLs only for application data](https://www.servicenow.com/docs/5cUvq1ceqhp6S1BCJb6xRQ "Avoid unauthorized or undesired access to application data by enforcing application-specific access control lists (ACLs) only for application data.") | Added two properties: sn_tf, sn_lco_cmn | | [Disable SQL error messages](https://www.servicenow.com/docs/guiUFSXBbDE3sbgGLDBPFg "Use the glide.db.loguser property to disable SQL error messages from rendering in a browser.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0263_default} | | [Minimize entity expansion threshold for GlideXMLUtil scriptable](https://www.servicenow.com/docs/yroBmazUmPpRjnn0fFwEGg "Use the glide.xmlutil.max_entity_expansion property to change the maximum entity expansion limit to a smaller number.") | Default value * (Old)\ * (New)3000 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0282_default} | | [Disable GlideRecord scope fencing legacy behavior](https://www.servicenow.com/docs/LuDiSg77tE8SZZIJ~3aFGg "The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0298_default} | | [Restrict Impersonation to Admin](https://www.servicenow.com/docs/bHu7La6XcWK6ZjlrCP9nIg "The glide.sys.permissive.impersonate property can be used to prevent non-admin roles from impersonating other users.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1032_default} | | [Restrict email domains for external user registration](https://www.servicenow.com/docs/svmAkApFyevDorXrm7wjww "Use the sn_ext_usr_reg.allowed_email_domains property to list acceptable external email domains.") | Rule Script: Script has been updated to improve detection accuracy | | [Remove remember me](https://www.servicenow.com/docs/EcnKADqCgq_UbeOW6DH7Rg "Use the glide.ui.forgetme property to remove the Remember Me check box from the login page to prevent login information from being cached.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0289_default} | | [Disable email OTP for multi-factor authentication](https://www.servicenow.com/docs/tELyJSQkfkXdY1eeHCZIzw "Manage how two-factor authentication is applied on your instance.") | * Functional impact * (Old)\ * (New)Users who rely solely on the email one time passcode as their multi-factor authentication method will no longer see that option on the MFA validation screen. They must enroll an alternative factor such as an authenticator app, a hardware security key, or SMS before this property is turned off, otherwise they may be unable to complete login until an administrator enrolls an alternative factor for them. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0395_functional} * Data type * (Old)\ * (New)Boolean {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0395_datatype} * Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0395_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0395_main} | | [Disable outbound SSLv2/SSLv3 connections](https://www.servicenow.com/docs/Kiaq6OfmDHZBF8JHoGM69w "Use the glide.outbound.sslv3.disabled property to force the MID Server to use TLS when making outbound connections, such as REST and SOAP requests. Normally, outbound connections from an instance are forced to use TLS instead of SSL.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0286_default} | | [Log user impersonation](https://www.servicenow.com/docs/cAZDdRKneESxjY53bGhvZQ "Configure glide.sys.log_impersonation to control if user-impersonating events are logged in your instance.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0528_default} | | [Enable ACLs to Control Live Profile Details](https://www.servicenow.com/docs/kU5Y6Q~0yI1At9IaL3HhbQ "Use the glide.live_profile.details property to designate whether a user should be able to view all detail fields, such as company name and phone numbers, in a live profile.") | Default value * (Old)\ * (New)ACL {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0261_default} | | [Deny unauthorized access to request items](https://www.servicenow.com/docs/9Ukq1RMf_HlfJLpPz2oNeA "The glide.sc.req_for.roles.default property defines a default behavior for the retrieveAddress API.") | Default value * (Old)\ * (New)deny {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0097_default} | | [Sanitize All Translated HTML Fields](https://www.servicenow.com/docs/GYUMHBrbJoe22MxCrkHdPQ "Learn how to configure the glide.translated_html.sanitize_all_fields property to the secure value to ensure that all translated_html elements are sanitized with an HTML sanitizer.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf1029_default} | | [Disable creating users from incoming emails](https://www.servicenow.com/docs/RiihD5dbGeXgSyY4iqe3lg "Use the glide.user.trusted_domain property to specify the comma-separated list of trusted domains used in the creation of users from incoming emails.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0272_default} | | [Restrict performance monitoring access](https://www.servicenow.com/docs/u6sR65NGAcejsd6U~da2kw "Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0220_default} | | [Require write access to access service catalog add item page](https://www.servicenow.com/docs/6weC0jpjMcN3uZGSTAzr5g "Use the glide.sc.request.add_item_write_access property to prevent unauthorized operations from being performed on catalog items.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0796_default} | | [Block access for delegated developers](https://www.servicenow.com/docs/1N8lB5kpR4tF2CbarxGZeg "This configuration affects access for delegated developers that are updating user roles through script. When the configuration is compliant, the developer will not be able to update or insert records into the sys_user_has_role table without also having the user_admin role.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0281_default} | | [Enforce strict security of session cookies](https://www.servicenow.com/docs/sE_azXIyy_sg93Om9J32gQ "Use the glide.ui.secure_cookies property to require properly formatted cookies") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0144_default} | | [Enforce field ACLs for inbound query requests](https://www.servicenow.com/docs/CVd5anxbrE5vKgd2TDyUSg "Manage how incoming queries are validated on your instance.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0444_default} | | [Minimize reset password request expiration duration](https://www.servicenow.com/docs/ruQByMtEJWtTvmzLGWEP2w "The password_reset.request.expiry denotes the time period in minutes during which a user must perform the password reset process.") | Default value * (Old)\ * (New)10 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0167_default} | | [Enforce URL allowlist check](https://www.servicenow.com/docs/ej7gYWsb0tJ~sia_5inVEw "Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.") | Default value * (Old)\ * (New)true,"" {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0117_default} | | [Limit UI active session life span](https://www.servicenow.com/docs/w2qrlyyHi2mymPqwEtZD6g "The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout.") | * Functional impact * (Old)Enforces max life-span on active authenticated HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions. The max life-span must be more than inactive timeout glide.ui.session_timeout (default 30 minutes). * (New)Authenticated UI sessions that exceed the configured lifespan are explicitly logged out. The session cookies are cleared and the session is invalidated, forcing the user to re-authenticate, rather than silently reissuing a new session ID as occurs with guest and integration sessions. Users must re-authenticate to continue working, even if they were actively using the platform when the session expired. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0875_functional} * Dependencies and prerequisites * (Old)\ * (New)This control interacts with the "glide.ui.session_timeout" property, which controls the UI idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message. {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0875_dependencies} * Default value * (Old)\ * (New)0 {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0875_default} {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0875_main} | | [Require authorization for import requests](https://www.servicenow.com/docs/XETJrOqdEi4sQI23Cjxleg "Use the glide.basicauth.required.importprocessor property to designate if incoming import requests should require basic authentication.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0059_default} | | [Enforce password reset on API requests](https://www.servicenow.com/docs/u3I5Z5iB6tr0zjkYhSddNw "Manage how the password reset functionality operates on your instance.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0365_default} | | [Disable external content URL](https://www.servicenow.com/docs/WjUBqtDZfOTbH5~cpiC4Dg "Manage how external link metadata is used in your instance with Connect Chat.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0151_default} | | [Enforce security rules to sharing dashboards](https://www.servicenow.com/docs/PCKXF5ejue7WsKH10C6EaA "Use the glide.cms.dashboards.sharing_with_secure_search property to control whether users can share dashboards.") | Default value * (Old)\ * (New)false {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0671_default} | | [Require authorization for unload requests](https://www.servicenow.com/docs/QT3Sfz7ZZpNUdm5MWgwCjQ "Use the glide.basicauth.required.unl (useUnloadFormat) property to designate if incoming unload requests should require basic authentication.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0065_default} | | [Disable adding default roles to skill ACLs](https://www.servicenow.com/docs/zGrT1Ea3TDWweA5xgcXxIg "Use system properties to control what roles are automatically added to generative AI skill ACLs.") | Functional impact * old Certain roles may be prevented from using skills if they do not satisfy an existing access control. These two property configurations will ensure certain roles always retain a base level of access to all skills. * New When the com.glide.one_extend.include_default_roles_for_skill_acl property is set to false, roles are no longer automatically granted access to generative AI skill ACLs --- any role that needs to execute a skill must satisfy the skill's own access control instead of relying on an automatically-added default role. The related "com.glide.one_extend.default_roles_for_skill_acl" property, which lists which roles get auto-added when com.glide.one_extend.include_default_roles_for_skill_acl is set to true, has no effect while it is set to false. | | [Require authorization for XML requests](https://www.servicenow.com/docs/BkE8b7R1CwZNBgIytNA9aQ "Use the glide.basicauth.required.xml property to designate if incoming XML requests should require basic authentication.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0067_default} | | [Require authorization for API requests](https://www.servicenow.com/docs/qc7ObGrermQMLjELeopRKA "Use the glide.basicauth.required.api property to enhance security for basic authorization for incoming REST requests.") | Default value * (Old)\ * (New)true {#updated-hardening-settings-for-baseline-version-nine__ul_aconf0055_default} | | [Enforce OCSP check on network error](https://www.servicenow.com/docs/uM6zGKep7fFGAoTvnrC95g "Learn how to configure the com.glide.communications.httpclient.ocsp_allow_network_error property to prevent bad actors from bypassing Online Certificate Status Protocol (OCSP) checks.") | Functional impact Old: \ New: When the com.glide.communications.httpclient.ocsp_allow_network_error property is set to false, an outbound HTTPS connection is not established if the OCSP responder becomes unreachable due to a network error, such as a timeout or DNS failure. Administrators should monitor OCSP responder availability after making this change, as any outbound integration with a temporarily unreachable OCSP responder will fail to connect. Dependencies and prerequisites Old: \ New: The com.glide.communications.httpclient.ocsp_allow_network_error property has no effect unless the com.glide.communications.httpclient.verify_revoked_certificate property, the overall gate for certificate revocation checking, is set to true. Data type Old: \ New: Boolean Default value Old: \ New: true | [ ] {#updated-hardening-settings-for-baseline-version-nine__table_baseline_v8_changes}