---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit guest's active session life span \[New in Security Center 1.3\]

# Limit guest's active session life span \[New in Security Center 1.3\] {#ariaid-title1}

Release version: Yokohama  
Updated May 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.
The glide.guest.active.session.life_span system property enforces a maximum lifespan on active guest HTTP sessions, regardless of session inactivity. The configured value is in minutes. A value of
<kbd class="ph userinput">0</kbd> disables the lifespan limit entirely, allowing sessions to persist until the inactive timeout fires. Guest users are unauthenticated users who access the instance without logging in.

Set the glide.guest.active.session.life_span system property to <kbd class="ph userinput">720</kbd>.

## More information {#sc-limit-guests-active-session-life-span__section_wc1_cqn_phc}

{#sc-limit-guests-active-session-life-span__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.guest.active.session.life_span |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | 720 |
| Default value | 0 |
| Fallback value | 0 |
| Category | [Session management](https://www.servicenow.com/docs/4wvXcp8l0BcUUdlL~tEurw "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: A larger maximum lifespan could allow an attacker to persist a stolen session for longer, increasing the scope of a security incident. {#sc-limit-guests-active-session-life-span__ul_vyn_fwf_p3c} |
| Functional impact | This configuration enforces max life-span on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero disables the lifespan limit entirely. The max life-span should be more than the inactive timeout glide.ui.session_timeout (default 30 minutes). |
| Dependencies and prerequisites | None |
[ ]

{#sc-limit-guests-active-session-life-span__table_ajc_b43_3kb}