Session management
reference australia Updated Sep 10, 2026 3 min read sc-session-management.md
This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.
- Apply continuous authentication policies to mobile sessions
Reduce the risk of session hijacking by applying continuous authentication policies to mobile sessions. - Minimize absolute session timeout duration
Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance. - Define active session timeout exception roles
Use a system property to exempt roles from active session timeout limits. - Enable UserCookie version 3.1
Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code. - Enforce password reset on API requests
Manage how the password reset functionality operates on your instance. - Enable HTTP Only Cookie Flag
Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies. - Enable MID Server governance checks
Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers. - Invalidate Session After OAuth Token Expiration [New in Security Center 2.0]
Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires. - Minimize concurrent interactive session quantity [Updated in Security Center 1.3]
Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user. - Limit concurrent sessions across all nodes
Use the glide.authenticate.limit.concurrent.sessions.across.all.nodes property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes. - Activate Limit Concurrent Sessions Plugin
Configure the com.glide.limit.concurrent.sessions plugin to reduce the chance of session hijacking on your instance. - Limit guest's active session life span
Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions. - Minimize Concurrent Interactive Sessions with Limit Concurrent Sessions Plugin
Manage the number of interactive sessions on your instance. - Limit integrations' active session life span
Use the glide.integrations.active.session.life_span property to enforce the maximum lifespan on active integration HTTP sessions, regardless of session inactivity. - Limit the policy-based mobile refresh token interval
Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate. - Limit UI active session life span
The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout. - Limit session length for high assurance sessions
Reduce the risk of account takeover in high assurance sessions by limiting session length - Proactively invalidate sessions after defined durations
The glide.active.session.timeout.invalidate.session property controls whether a timed-out session is proactively invalidated before the Tomcat server processes it. - Require JWT trust verification for guest embedded sessions
The glide.embedded.session.trust.verification.enabled property determines whether guest embeddable sessions require JSON Web Tokens (JWT) validation for third-party origin verification. - Rotate HTTP session identifiers
Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities. - Minimize concurrent interactive session quantity [Updated in Security Center 1.3]
Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user. - Minimize session activity timeout duration
Use the glide.ui.session_timeout property to set the session activity timeout duration in minutes. - Minimize session window timeout duration
Use the glide.ui.user_cookie.life_span_in_days property to set the expiration time period for the Remember Me cookie. The default value is 15 days and the maximum cap is at 30 days.
Parent Topic:Hardening settings
68 lines · 10.2 KB
--- title: Session management description: This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/instance-security-hardening-settings/sc-session-management.html release: australia product: Instance Security Hardening Settings classification: instance-security-hardening-settings topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 3 breadcrumb: [Hardening settings, Platform Security] --- # Session management This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication. - **[Apply continuous authentication policies to mobile sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-apply-continuous-authentication-policies-to-mobile-sessions.md)** Reduce the risk of session hijacking by applying continuous authentication policies to mobile sessions. - **[Minimize absolute session timeout duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-absolute-session-timeout.md)** Use the **glide.ui.user\_cookie.max\_life\_span\_in\_days** property to set a maximum life span for user cookies created when users log in with the **Remember Me** checkbox selected. When the cookie expires, users who have selected the **Remember Me** checkbox are forced to reauthenticate into the instance. - **[Define active session timeout exception roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-define-active-session-timeout-exception-roles.md)** Use a system property to exempt roles from active session timeout limits. - **[Enable UserCookie version 3.1](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-usercookie-version-3-1.md)** Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code. - **[Enforce password reset on API requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-password-reset-on-api-requests.md)** Manage how the password reset functionality operates on your instance. - **[Enable HTTP Only Cookie Flag](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-http-only-cookie-flag.md)** Use the **glide.cookies.http\_only** property to enable the HTTPOnly attribute for sensitive cookies. - **[Enable MID Server governance checks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-mid-server-governance-checks.md)** Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers. - **[Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-invalidate-session-after-oauth-token-expiration.md)** Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires. - **[Minimize concurrent interactive session quantity \[Updated in Security Center 1.3\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-glide-authenticate-max-concurrent-interactive-sessions.md)** Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user. - **[Limit concurrent sessions across all nodes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-concurrent-sessions-across-all-nodes.md)** Use the **glide.authenticate.limit.concurrent.sessions.across.all.nodes** property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes. - **[Activate Limit Concurrent Sessions Plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-concurrent-sessions-plugin.md)** Configure the com.glide.limit.concurrent.sessions plugin to reduce the chance of session hijacking on your instance. - **[Limit guest's active session life span](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-guests-active-session-life-span.md)** Use the **glide.guest.active.session.life\_span** property to control the duration of an active guest's HTTP sessions. - **[Minimize Concurrent Interactive Sessions with Limit Concurrent Sessions Plugin](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-glide-authenticate-limit-concurrent-interactive-sessions.md)** Manage the number of interactive sessions on your instance. - **[Limit integrations' active session life span](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-integrations-active-session-life-span.md)** Use the **glide.integrations.active.session.life\_span** property to enforce the maximum lifespan on active integration HTTP sessions, regardless of session inactivity. - **[Limit the policy-based mobile refresh token interval](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-policy-based-session-access-mobile-refresh.md)** Use the **glide.authenticate.session\_access.mobile.refresh\_token\_interval** property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate. - **[Limit UI active session life span](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-ui-active-session-life-span.md)** The **glide.ui.active.session.life\_span** property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout. - **[Limit session length for high assurance sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-limit-session-length-for-high-assurance-sessions.md)** Reduce the risk of account takeover in high assurance sessions by limiting session length - **[Proactively invalidate sessions after defined durations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-proactively-invalidate-inactive-sessions.md)** The **glide.active.session.timeout.invalidate.session** property controls whether a timed-out session is proactively invalidated before the Tomcat server processes it. - **[Require JWT trust verification for guest embedded sessions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-jwt-trust-verification-for-guest-embedded-sessions.md)** The **glide.embedded.session.trust.verification.enabled** property determines whether guest embeddable sessions require JSON Web Tokens \(JWT\) validation for third-party origin verification. - **[Rotate HTTP session identifiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-rotate-http-session-identifiers.md)** Use the **glide.ui.rotate\_sessions** property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities. - **[Minimize concurrent interactive session quantity \[Updated in Security Center 1.3\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-minimize-concurrent-interactive-session-quantity.md)** Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user. - **[Minimize session activity timeout duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-session-activity-timeout.md)** Use the **glide.ui.session\_timeout** property to set the session activity timeout duration in minutes. - **[Minimize session window timeout duration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-session-window-timeout.md)** Use the **glide.ui.user\_cookie.life\_span\_in\_days** property to set the expiration time period for the Remember Me cookie. The default value is 15 days and the maximum cap is at 30 days. **Parent Topic:**[Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/security-hardening-settings.md)
| title | Session management |
| description | This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/platform-security/instance-security-hardening-settings/sc-session-management.html |
| release | australia |
| product | Instance Security Hardening Settings |
| classification | instance-security-hardening-settings |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 3 |
| breadcrumb | Hardening settingsPlatform Security |