Updated hardening settings for baseline version 9.0

Some hardening settings have been updated with the release of Security Center baseline version 9.0.

Documentation	Updates
Disable AJAXEvaluate	Default value - (Old) <blank> (New) false
Enforce field-level ACLs on records created from the filtered list view UI query string	Short description (Old) Enforce field-level ACLs on records created from the query string of the Filtered List view UI of a table `- \(New\)` Enforce field ACLs on records created from Filtered List view UI query string Functional impact Old When com.glide.acl_check_all_filter_on_new is set to true, then ACLs may prevent fields included in the filter query string from affecting the value of fields in a created record when the creation is triggered from the list view UI of a table. However, this previous behavior was incorrect as it bypassed ACLs and allowed user without creation access to a field to modify its value. `- New` When the com.glide.acl_check_all_filter_on_new is set to true, ACLs are enforced for fields included in the filter query string during record creation from the list view UI. This prevents users without create access from modifying protected fields through filter parameters.
Escape XML markup	Default value- (Old) <blank> (New) true
Turn off verbose SQL error messages for import processor	Default value- (Old) <blank> (New) true
Require authorization for excel requests	Default value- (Old) <blank> (New) true
Enable protected tables plugin	Remediation (Old) Set the Glide Property com.glide.security.protected_table.enabled to true. This requires a user with the security_admin role. `- \(New\)` Enable table protection through the guided activation flow: `1. Navigate to the Protected Tables plugin's guided activation flow. 2. Complete the activation process to enable table protection. Only users with the security\_admin role can activate this control.` Important: Don't enable this control by directly editing the property com.glide.security.protected_table.enabled outside that guided activation flow. Default protected tables: syslog, syslog_transaction, sys_outbound_http_log, sysevent, sys_audit, sys_push_notification, protected_table_configuration, syslog_app_scope To extend protection to additional tables, configure insert, update, and delete protection rules for each additional table and operation in the Protected Table Configuration list. Security risk Old Log integrity must be maintained to allow discovery of malicious activity. `- New` When disabled (the default), Protected Tables protections don't apply, allowing maintenance-role users to modify or delete critical audit and security logs without detection. An attacker with maintenance credentials could tamper with syslog, sys_audit, and sysevent entries to cover malicious activity and evade forensic investigation. Disabling this property compromises the audit trail needed to detect and investigate security incidents. Functional impact Old <blank> New Enabling the com.glide.security.protected_table.enabled property causes create, update, and delete attempts on tables in the Protected Table Configuration list to be evaluated. Depending on that table's configured protection level, the attempt is blocked, logged, or ignored. The level shipped per table is not fixed. It depends on how long the Protected Tables plugin has been installed, so confirm the actual values on your instance rather than assuming a table is blocking. One exception holds everywhere: insert attempts on sysevent are never blocked or logged, since normal processing inserts sysevent records continuously. A refused attempt shows the message "Modifications to <table> have been refused due to the Protected Table configuration. Please contact your system administrator." Any integration or business rule currently writing to or deleting from a blocking table will start failing once this property is enabled. Default value Old <blank> New false
Enable Jelly JS interpolation protection	Functional impact Old <blank> New Enabling this property causes the platform to reject Jelly JavaScript expressions that aren't explicitly recognized as safe or marked as SAFE. Instance owners should test custom UI pages, macros, and portal widgets that use Jelly-interpolated JavaScript expressions after making this change, and confirm that legitimate expressions continue to render as expected. Custom Jelly content that relies on dynamic, unmarked expressions may need to be updated to use the SAFE designation to continue functioning. Default value Old <blank> New true in Australia and newer, false prior Fallback value Old false `- New` true in Australia and newer, false prior
Restrict permissions for CMDB model	Default value- (Old) <blank> (New) false
https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-chat-server-debugging.md	Default value- (Old) <blank> (New) false
Escape scripts in scratchpad	Default value- (Old) <blank> (New) true
Disable locked form elements debugging	Default value- (Old) <blank> (New) true
Configure service portal widgets table allow list	Default value- (Old) <blank> (New) '' (empty string)
Minimize session activity timeout duration	Description (Old) This property determines the user session timeout. This determines how long a user session stays active. If glide.ui.session_timeout is not set to the recommended value of "60" minutes or less, then the session may stay valid for long even without activity. This could provide too large of a time window to enable session hijacking attacks. `- \(New\)` The glide.ui.session_timeout property controls the inactive session timeout for authenticated users, specified in minutes. If this property is not set to the recommended value of 30 minutes or less, the session may remain valid for extended periods without user activity. A long session timeout allows inactive sessions to remain valid for extended periods, increasing the chance that an attacker could hijack the session before it expires. Remediation (Old) Ensure the property glide.ui.session_timeout is set to 60 or less. `- \(New\)` Navigate to /sys_properties_list.do on the instance. Ensure the glide.ui.session_timeout property does not exist in the sys_properties table or is set to 30 minutes or less. Functional impact (Old) <blank> (New) Reducing the glide.ui.session_timeout property lowers the amount of idle time allowed before a user's session ends automatically, requiring re-authentication. Users who leave a session idle longer than the configured value (for example, while completing a long form, waiting on an approval, or stepping away between tasks) will be logged out and must sign in again. Administrators should verify that long-running interactive workflows still complete comfortably within the new timeout window. Confirm that any automation or integration currently relying on a long-lived interactive UI session is migrated to a dedicated authentication method such as OAuth or a service account. Dependencies and prerequisites (Old) <blank> (New) The glide.ui.session_timeout property is capped by the static property glide.ui.max_session_timeout, which limits the maximum effective value to 1440 minutes. Data type (Old) <blank> (New) integer Default value (Old) <blank> (New) 30
Set automatic token cleanup for token credentials	Default value- (Old) <blank> (New) true, 7
Prevent impersonating user from viewing application data	Plugin applicability- (Old) <blank> (New) sn_opp_market, sn_jny, sn_imt_vaccine, sn_imt_health_test, sn_hr_core, sn_egd_goals, sn_egd_core, sn_egd_act, sn_em, sn_talent_aia, sn_ecn
Require authorization for JSONv2 request	Default value- (Old) <blank> (New) true
Implement the x-frame-options: SAMEORIGIN security header	Default value- (Old) <blank> (New) true
Maximize reset password SMS complexity	Default value- (Old) <blank> (New) 6
Limit integrations' active session life span	Description (Old) This configuration will enforce max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes and the value of zero will disable timing out the active sessions. A larger maximum lifespan could allow an attacker to persist in a stolen session for longer, increasing the scope of a security incident. This particular property is limited to integrations that have low-privilege access to an instance. `- \(New\)` The glide.integrations.active.session.life_span property enforces the maximum lifespan on active integration HTTP sessions, regardless of session inactivity. The configured value is in minutes. A value of zero disables the lifespan limit entirely, allowing sessions to persist indefinitely until the inactive timeout fires. This particular property is limited to integrations that have low-privilege access to an instance. A larger maximum lifespan allows an attacker to persist a stolen session for longer, increasing the scope of a security incident. Remediation (Old) Set the Glide Property 'glide.integrations.active.session.life_span' to a value greater than 0 and less than or equal to 720. `- \(New\)` Navigate to /sys_properties_list.do on the instance. Ensure the glide.integrations.active.session.life_span property exists and is set to a value greater than 0 and less than or equal to 720 minutes. Functional impact (Old) <blank> (New) Integration sessions that exceed the configured lifespan are silently invalidated and reissued a new session ID. The integration user sees no error, but any session-scoped state accumulated during that session is lost and starts fresh. Dependencies and prerequisites (Old) <blank> (New) This control interacts with the glide.integration.session_timeout property, which controls the integration idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the integration idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message.
Limit concurrent sessions across all nodes	Default value- (Old) <blank> (New) true
Minimize reset password SMS expiry duration	Default value- (Old) <blank> (New) 5
Double check inbound transactions	Default value- (Old) <blank> (New) true
Disable soap fault stack trace display	Default value- (Old) <blank> (New) false
Limit Invalid Password Reset Attempts	Default value- (Old) <blank> (New) 3
Anti-CSRF token validation time	Default value- (Old) <blank> (New) 86400
Require CAPTCHA for guest walk-up experience in customer service application	Default value- (Old) <blank> (New) true
Require authorization for csv requests	Default value- (Old) <blank> (New) true
Enable Identity and Access Audit tool	Configuration name- (Old) glide.identity.security.audit.enabled (New) glide.identity.security.audit.enabled, com.glide.security.audit
Disable public access to favorites	Default value- (Old) <blank> (New) false
Proactively invalidate sessions after defined durations	Default value- (Old) <blank> (New) false
Escape JavaScript [Updated in Security Center 1.3]	Default value- (Old) <blank> (New) true
Enable HTTP Only Cookie Flag	Default value- (Old) <blank> (New) true
Enforce SOAP request strict security	Default value- (Old) <blank> (New) true
Block rooted or jailbroken mobile devices	Default value- (Old) <blank> (New) false
Enforce strict elevate privilege	Default value- (Old) <blank> (New) true
Enable the hardened java security manager	Default value- (Old) <blank> (New) com.glide.sys.security.ContextualSecurityManager
Disable legacy JQuery behavior	Default value- (Old) <blank> (New) false
Enable account recovery	Description (Old) This property controls the account recovery feature, which binds the ability to bypass single sign-on to specifically designated administrators. If "glide.sso.acr.enabled" is not set to the recommended value of "true", then the local interactive log-ins (username or password based) will be remain enabled when single sign-on is enabled on the instance. `- \(New\)` The glide.sso.acr.enabled property controls whether the Account Recovery (ACR) feature is available on an instance configured for Single Sign-On (SSO) authentication. When set to the recommended value of "true", the platform blocks turning on multi-SSO until account recovery is enabled. At least one user account must be enrolled for it. It also confines any session authenticated through the recovery path to writing only SSO- and account-recovery-related configuration. This preserves a controlled, auditable path back into the system for users who lose access to their normal SSO credentials. Security risk (Old) Eliminating local interactive log-ins reduces the potential for unauthorized access to the instance. `- \(New\)` Without an account recovery path, a user who loses access to their normal sign-in method has no supported way back into the system. That gap commonly pushes administrators and help desks toward manual, ad hoc identity verification workarounds to restore access. Those workarounds are a well-known target for social engineering and account takeover because they bypass the organization's standard authentication controls. Leaving a recovery path unavailable increases the risk of unauthorized account access and loss of control over who can regain entry to affected accounts. Functional impact (Old) <blank> (New) Enabling this control doesn't disable SSO. It requires that an account-recovery path exist and restricts write access on a recovery-authenticated session to SSO- and recovery-related properties only. Admin users that have never configured account recovery, or that have zero users enrolled, will be blocked from turning on Multi-SSO until at least one user opts in. Users may test the Multi-SSO activation flow and the account-recovery login flow when removing or disabling ACR-enrolled users. Data type (Old) <blank> (New) Boolean Default value (Old) <blank> (New) true
Enforce strict user image upload	Default value- (Old) <blank> (New) true
Verify certificate chain and hostname	Functional impact (Old) <blank> (New) When the com.glide.communications.httpclient.verify_hostname property is set to true, an outbound HTTPS connection is rejected if the remote host's certificate doesn't match the requested hostname or its certificate chain can't be validated. Outbound integrations to hosts with a mismatched or misconfigured certificate will fail to connect once this property is set to true. Dependencies and prerequisites (Old) <blank> (New) The "com.glide.communications.httpclient.verify_hostname" property governs hostname and certificate chain validation independently of the "com.glide.communications.httpclient.verify_revoked_certificate" property, the overall gate for certificate revocation checking. Data type (Old) <blank> (New) Boolean
Minimize session window timeout duration	Default value- (Old) <blank> (New) 15
Maximize reset password verification delay duration	Default value- (Old) <blank> (New) 1000
Log session audit events	Default value- (Old) <blank> (New) true
Ensure archive table ACLs are checked	Default value- (Old) <blank> (New) true
Enforce HTML sanitization	Default value- (Old) <blank> (New) enforce
Enable CAPTCHA for external user registration	Rule Script: Script has been updated to improve detection accuracy Default value (Old) <blank> (New) true
Require AJAXGlideRecord ACL checking	Default value- (Old) <blank> (New) true
Require Minimum and Maximum Password Length	Rule script: Script has been updated to improve detection accuracy.
Enable password reset policy checks	Default value- (Old) <blank> (New) true
Enforce oauth state parameter validation	Default value- (Old) <blank> (New) true
Restrict Global App Development by Role	ODefault value- (Old) <blank> (New) false
Restrict knowledge bases access	Default value- (Old) <blank> (New) true
Timeout guest sessions	Description (Old) Use the glide.guest.session_timeout system property to control the inactive session timeout for unauthenticated users. By default, the value of this property is 30 minutes. If there are availability concerns from persisting too many sessions in memory, the value of this property can be lowered to 5. Avoid setting this property greater than 30, as large timeout values increase the number of sessions persisted by the instance, and may cause minor availability concerns. Avoid setting this property greater than 30. Large timeout values increase the number of sessions persisted by the instance, and may cause minor availability concerns. `- \(New\)` The glide.guest.session_timeout property controls the inactive session timeout for unauthenticated (guest) users, specified in minutes. New instances are provisioned with a default of 5 minutes. If the property does not exist in the sys_properties table, the effective value defaults to 0. When set to 0, the guest-specific override is turned off and the session instead uses the general UI session timeout (glide.ui.session_timeout). Setting the glide.guest.session_timeout property greater than 30 minutes increases the number of sessions persisted by the instance, which may cause minor availability concerns. Remediation (Old) Ensure the Glide Property 'glide.guest.session_timeout' is configured to the default value of 30. In the rare case there are availability concerns from persisting too many sessions in memory, the value of this property can be lowerered to 5. `- \(New\)` Navigate to /sys_properties_list.do on the instance. Ensure the glide.guest.session_timeout property exists and is set to a value greater than 0 and less than or equal to 30 minutes. Dependencies and prerequisites (Old) <blank> (New) The glide.guest.session_timeout property interacts with the glide.ui.session_timeout property. When glide.guest.session_timeout is set to 0, guest sessions don't receive an independent idle timeout — they fall back to using glide.ui.session_timeout instead. Default value (Old) 30 `- \(New\)` 5
Restrict flow context read access	Default value- (Old) <blank> (New) true
Minimize external user registration link expiration duration	Rule Script: Script has been updated to improve detection accuracy Default value (Old) <blank> (New) 3
Require authorization for SCHEMA requests	Default value- (Old) <blank> (New) true
Enable IAM and boundary checks for Amazon Bedrock access	Short description- (Old) Enable multiple (permission policy and boundary) checks to ensure that the Role is privileged in AWS/Bedrock (New) Enable IAM and Boundary Checks for Amazon Bedrock access
Enable UserCookie version 3.1	Default value- (Old) <blank> (New) true
Limit guest's active session life span	Description (Old) This configuration will enforce max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes and the value of zero will disable timing out the active sessions. This particular property is limited to Guest users, which have low privilege access to an instance. `- \(New\)` The glide.guest.active.session.life_span property enforces a maximum lifespan on active guest HTTP sessions, regardless of the session activity. The configured value is in minutes. A value of zero disables the lifespan limit entirely, allowing sessions to persist indefinitely until the inactive timeout fires. Guest users are unauthenticated users who access the instance without logging in. Rule script: Script has been updated to improve detection accuracy Functional impact (Old) <blank> (New) Guest HTTP sessions that exceed the configured lifespan are silently invalidated and reissued a new session ID. The guest user sees no error or logout screen, but any session-scoped state (for example, in-progress form data, embedded portal widget context, or session-based rate limiting) accumulated during that session is lost and starts fresh. Legitimate guest users on long-running but otherwise idle browser tabs may need to reload the page after the configured interval elapses. Dependencies and prerequisites (Old) <blank> (New) This control interacts with the glide.guest.session_timeout property, which controls the guest idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message. Data type (Old) <blank> (New) integer
Configure service portal widgets allow list	Default value- (Old) <blank> (New) ''
Require authorization for XML output requests	Default value- (Old) <blank> (New) true
Enforce production instance behavior	Default value- (Old) <blank> (New) true
Restrict HR case updates from personal emails	Default value- (Old) <blank> (New) true
Restrict JSONP requests to trusted URLs	Default value- (Old) <blank> (New) true
Minimize reset password request success window duration	Default value- (Old) <blank> (New) 1440
Activate role based multi-factor authentication	Functional impact (Old) <blank> (New) Users assigned the admin, security_admin, or user_admin role will be prompted for a second authentication factor at login, and their password. Users without one of these roles are unaffected. Dependencies and prerequisites (Old) <blank> (New) For role-based MFA enforcement to take effect, glide.authenticate.multifactor must be set to "true" and multi_factor_criteria must be active. Default value (Old) <blank> (New) false,"The multi_factor_criteria table record with sys_id d427668b73003300fdbd04fbc4f6a7b6 is shipped in a zbooted instance but is not set to active"
Require authorization for RSS requests	Default value- (Old) <blank> (New) true
Apply domain separation on dot walked fields	Default value- (Old) <blank> (New) false
Disable logger for low privilege users in script sandbox	Default value- (Old) <blank> (New) true
Maximum allowed attachment size	Default value- (Old) <blank> (New) 1024
Maximize reset password request unlock window duration	Default value- (Old) <blank> (New) 1440
Require authorization for PDF requests	Default value- (Old) <blank> (New) true
Enable antivirus scan	Default value- (Old) <blank> (New) true
Prevent empty ACL creation	Default value- (Old) <blank> (New) true
Disable Multi-SSO debugging	Default value- (Old) <blank> (New) false
Escape Excel formulas	Default value- (Old) <blank> (New) true
Disable JavaScript tags in embedded HTML	Default value- (Old) <blank> (New) false
Prevent usage of 3DES keys	Dependencies & prerequisites- (Old) <blank> (New) The property glide.security.3des.removal_job_status acts as a readiness gate. The scheduled job walks through deactivating/rotating out old 3DES static keys, and that job reports its progress via this status property. Until that job reports it's done (KEYS_DEACTIVATED or RESUPPLIED), it's not yet possible to flip glide.security.3des.static_keys_usable to false, because doing so prematurely could break decryption of data still encrypted with those static keys.
Restrict downloadable MIME types	Default value- (Old) <blank> (New) true
Prevent inactive users from logging in	Default value- (Old) <blank> (New) true
Enable HTML sanitizer within Virtual Agent	Default value- (Old) <blank> (New) true
Enable policy based session access for mobile	Default value- (Old) <blank> (New) true
Enable report view ACLs	Default value- (Old) <blank> (New) true
Restricted Binding functionality in Case Bearer authorization	Rule script: Script has been updated to improve detection accuracy Default value (Old) false `- \(New\)` true
Maximize reset password request retry window duration	Default value- (Old) <blank> (New) 1440
Deny by default with empty ACLs	Default value- (Old) <blank> (New) deny
Disable unauthenticated published reports	Default value- (Old) <blank> (New) false
Minimize SMTP Recipient Quantity	Default value- (Old) <blank> (New) 100
Clear pasteboard when app backgrounds	Default value- (Old) <blank> (New) false
Restrict uploaded MIME types	Default value- (Old) <blank> (New) true
Enable ACLs for Encoded Query in Simple List Widget	Default value- (Old) <blank> (New) true
Require Authorization for XSD Requests	Default value- (Old) <blank> (New) true
Enable SMS code notification for enrollment and verification	Default value- (Old) <blank> (New) true
Use of secure insert multiple operation within import set API	Default value- (Old) <blank> (New) false
Define restricted downloadable MIME types	Description (Old) If glide.ui.attachment.download_mime_types does include dangerous MIME types such as text/html, image/svg ,image/svg+xml,application/xml, then dangerous files could be rendered inline in the browser, which could lead to Cross Site Scripting attacks (XSS). This property is the list of comma-separated attachment mime types, which won't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. Maintaining this list properly prevents cross-site scripting attacks. If the glide.ui.attachment.download_mime_types system property doesn't include dangerous MIME types such as "text/html, image/svg,image/svg+xml,application/xml", then dangerous files could be rendered inline in the browser. This can lead to Cross Site Scripting (XSS) attacks. This check is only relevant when glide.ui.attachment.force_download_all_mime_types is set to false. This property is a list of comma-separated attachment MIME types, which don't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. `- \(New\)` If the glide.ui.attachment.download_mime_types property doesn't include dangerous MIME types such as text/html, image/svg, image/svg+xml, application/xml, and application/xhtml+xml, then those dangerous files could be rendered inline in the browser, which could lead to Cross-Site Scripting (XSS) attacks. This property is a comma-separated list of attachment MIME types that are downloaded to the client and don't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as attachments rather than viewed inline in the browser. Maintaining this list properly by including all dangerous MIME types prevents Cross-Site Scripting attacks. Note: This property's protection is only relevant when the glide.ui.attachment.force_download_all_mime_types property is set to false. Fallback value (Old) text/html,image/svg,image/svg+xml,application/xml `- \(New\)` ''
Verify certificate revocation	Functional impact (Old) <blank> `- \(New\)` When the com.glide.communications.httpclient.verify_revoked_certificate is set to true, every outbound HTTP request over TLS has its certificate checked for revocation using OCSP or CRL, as governed by the other properties in this family. When this property is set to "false", no revocation checking is performed at all for outbound TLS connections, regardless of how the other certificate-revocation properties are configured. Data type (Old) <blank> `- \(New\)` Boolean Default value (Old) <blank> `- \(New\)` true
Honor admin override ACLs	Description (Old) ACLs are evaluated cumulatively. If there are a number of ACLs on any given field and the Admin Overrides option is false (not selected) on one of them, then the effective admin overrides for all the ACLs are considered to be false. This causes admins to be unable to pass even the ACL where the override should be in effect. If "glide.security.admin.override.accessterm" is not set to the recommended value of "true" then, even if one of the ACL terms under the ACL rule is "Admin overrides" false, the entire rule evaluates to false. `- \(New\)` The "glide.security.admin.override.accessterm" property controls how the platform decides whether an administrator can bypass an access rule when a resource (a table, a field) has more than one access rule applied to it. Each individual access rule can be configured to grant or deny an admin override on its own. When this property is set to its recommended value of true, the per-rule setting is honored individually. A rule explicitly configured to deny an admin override still blocks the administrator even if another rule on the same resource permits one. When set to "false", the bypass decision is instead made at a broader, combined level. This can let an administrator through even though one of the applicable rules was specifically configured to block the override. Security risk (Old) ACLs with conflicting "Admin overrides" settings may cumulatively evaluate to false, potentially preventing administrators from accessing fields they should have access to and inadvertently causing denial of access to critical data. `- \(New\)` When access checks are evaluated coarsely, a privileged user can access a resource despite rules set to deny override. This allows the most restrictive protection to be ignored in favor of a more permissive rule on the same resource. Protected data can be set to readable or writable, risking unauthorized access to sensitive information. Functional impact (Old) <blank> `- \(New\)` Changing this property to true affects only elevated-admin access decisions on resources governed by more than one access rule; regular users and single-rule resources see no behavior change. After the change, test contextual security scenarios where an admin role is granted access to a field or record through multiple layered rules, confirming that a rule explicitly configured to deny override still blocks the admin as expected. No service availability impact is expected since the change only tightens an authorization decision path. Data type (Old) <blank> `- \(New\)` Boolean Default value (Old) <blank> `- \(New\)` true Fallback value (Old) true `- \(New\)` false
Set safe content security policy for SVG files	Default value- (Old) <blank> (New) true
Check UI action conditions before execution	Default value- (Old) <blank> (New) true
Disable inbound emails for locked out users	Default value- (Old) <blank> (New) false
Rotate HTTP session identifiers	Default value- (Old) <blank> (New) true
Escape jelly script	Default value- (Old) <blank> (New) true
Set Xframe options to prevent embedding third-party websites	Default value- (Old) <blank> (New) sameorigin
Require authorization for WSDL request	Default value- (Old) <blank> (New) true
Minimize absolute session timeout duration	Default value- (Old) <blank> (New) 30
Limit the policy-based mobile refresh token interval	Default value- (Old) <blank> (New) 1800
Control lockout time for invalid password reset attempts	Default value- (Old) <blank> (New) 1440
Limit max subscriptions per user per day	Default value- (Old) <blank> (New) 500
Restrict access to emails with empty target table	Default value- (Old) <blank> (New) false
Enable CAPTCHA in password reset	Default value- (Old) <blank> (New) false
Validate SOAP content type	Default value- (Old) <blank> (New) true
Disable secure cookie debugging	Default value- (Old) <blank> (New) false
Limit max comments per user per day	Default value- (Old) <blank> (New) 500
Validate remote host	Default value- (Old) <blank> (New) true
Require authorization for data broker rest API	Default value- (Old) <blank> (New) true
Require authorization for script requests	Default value- (Old) <blank> (New) true
Disallow infected file download	Functional impact (Old) <blank> (New) Users can download non-scanned attachments if the antivirus service is down or unreachable. Default value (Old) true `- \(New\)` false
Require authentication by default for client-callable script includes	Default value- (Old) <blank> (New) false
Enforce relative links	Default value- (Old) <blank> (New) true
Require obfuscation of mobile app UI	Default value- (Old) <blank> (New) false
Restrict access to GlideSystemUserSession scriptable API	Default value- (Old) true (New) false
Enable work order management query rules for service organizations	Default value- (Old) <blank> (New) false
Enforce device encryption and passcode requirements [New in Security Center 1.3]	Default value- (Old) <blank> (New) false
Require authorization for SOAP requests	Technical Configuration Name (Old) glide.basicauth.required.soap, glide.soap.require_ws_security `- \(New\)` glide.basicauth.required.soap,glide.soap.require_ws_security Rule script: Script has been updated to improve detection accuracy Security risk (Old) Unauthenticated access to SOAP export data, when combined with misconfigured guest user role, poses a significant risk of unauthorized data exposure. `- \(New\)` When set to false, both properties allow unauthenticated SOAP requests to map to the guest user and execute without credential validation, enabling unauthorized data export and system operations. Functional impact (Old) <blank> (New) Disabling either property relaxes SOAP request authentication requirements. Basic auth and/or WS-Security validation is set to optional, allowing unauthenticated or weakly-authenticated SOAP requests to proceed. Data tyype (Old) <blank> (New) Boolean Default value (Old) <blank> (New) true,false Fallback value (Old) true,true `- \(New\)` true,false
Enforce application specific ACLs only for application data	Added two properties: sn_tf, sn_lco_cmn
Disable SQL error messages	Default value- (Old)<blank> (New) false
Minimize entity expansion threshold for GlideXMLUtil scriptable	Default value- (Old)<blank> (New) 3000
Disable GlideRecord scope fencing legacy behavior	Default value- (Old)<blank> (New) false
Restrict Impersonation to Admin	Default value- (Old)<blank> (New) false
Restrict email domains for external user registration	Rule Script: Script has been updated to improve detection accuracy
Remove remember me	Default value- (Old)<blank> (New) true
Disable email OTP for multi-factor authentication	Functional impact (Old)<blank> (New) Users who rely solely on the email one time passcode as their multi-factor authentication method will no longer see that option on the MFA validation screen. They must enroll an alternative factor such as an authenticator app, a hardware security key, or SMS before this property is turned off, otherwise they may be unable to complete login until an administrator enrolls an alternative factor for them. Data type (Old)<blank> (New) Boolean Default value (Old)<blank> (New) true
Disable outbound SSLv2/SSLv3 connections	Default value- (Old)<blank> (New) true
Log user impersonation	Default value- (Old)<blank> (New) true
Enable ACLs to Control Live Profile Details	Default value- (Old)<blank> (New) ACL
Deny unauthorized access to request items	Default value- (Old)<blank> (New) deny
Sanitize All Translated HTML Fields	Default value- (Old)<blank> (New) true
Disable creating users from incoming emails	Default value- (Old)<blank> (New) false
Restrict performance monitoring access	Default value- (Old)<blank> (New) true
Require write access to access service catalog add item page	Default value- (Old)<blank> (New) true
Block access for delegated developers	Default value- (Old)<blank> (New) true
Enforce strict security of session cookies	Default value- (Old)<blank> (New) true
Enforce field ACLs for inbound query requests	Default value- (Old)<blank> (New) true
Minimize reset password request expiration duration	Default value- (Old)<blank> (New) 10
Enforce URL allowlist check	Default value- (Old)<blank> (New) true,""
Limit UI active session life span	Functional impact (Old) Enforces max life-span on active authenticated HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions. The max life-span must be more than inactive timeout glide.ui.session_timeout (default 30 minutes). `- \(New\)` Authenticated UI sessions that exceed the configured lifespan are explicitly logged out. The session cookies are cleared and the session is invalidated, forcing the user to re-authenticate, rather than silently reissuing a new session ID as occurs with guest and integration sessions. Users must re-authenticate to continue working, even if they were actively using the platform when the session expired. Dependencies and prerequisites (Old)<blank> (New) This control interacts with the "glide.ui.session_timeout" property, which controls the UI idle-session timeout duration. The platform requires the active session maximum lifespan to be greater than or equal to the idle timeout. If the active session lifespan is configured to a value lower than the idle-session timeout, the platform automatically increases the effective lifespan to match the idle-session timeout and logs a warning message. Default value (Old)<blank> (New) 0
Require authorization for import requests	Default value- (Old)<blank> (New) true
Enforce password reset on API requests	Default value- (Old)<blank> (New) true
Disable external content URL	Default value- (Old)<blank> (New) false
Enforce security rules to sharing dashboards	Default value- (Old)<blank> (New) false
Require authorization for unload requests	Default value- (Old)<blank> (New) true
Disable adding default roles to skill ACLs	Functional impact old Certain roles may be prevented from using skills if they do not satisfy an existing access control. These two property configurations will ensure certain roles always retain a base level of access to all skills. New When the com.glide.one_extend.include_default_roles_for_skill_acl property is set to false, roles are no longer automatically granted access to generative AI skill ACLs — any role that needs to execute a skill must satisfy the skill's own access control instead of relying on an automatically-added default role. The related "com.glide.one_extend.default_roles_for_skill_acl" property, which lists which roles get auto-added when com.glide.one_extend.include_default_roles_for_skill_acl is set to true, has no effect while it is set to false.
Require authorization for XML requests	Default value- (Old)<blank> (New) true
Require authorization for API requests	Default value- (Old)<blank> (New) true
Enforce OCSP check on network error	Functional impact Old: <blank> New: When the com.glide.communications.httpclient.ocsp_allow_network_error property is set to false, an outbound HTTPS connection is not established if the OCSP responder becomes unreachable due to a network error, such as a timeout or DNS failure. Administrators should monitor OCSP responder availability after making this change, as any outbound integration with a temporarily unreachable OCSP responder will fail to connect. Dependencies and prerequisites Old: <blank> New: The com.glide.communications.httpclient.ocsp_allow_network_error property has no effect unless the com.glide.communications.httpclient.verify_revoked_certificate property, the overall gate for certificate revocation checking, is set to true. Data type Old: <blank> New: Boolean Default value Old: <blank> New: true

**Parent Topic:**[Updated hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/hardening-settings-updated.md)

title	Updated hardening settings for baseline version 9.0
description	Some hardening settings have been updated with the release of Security Center baseline version 9.0.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/australia/platform-security/instance-security-hardening-settings/updated-hardening-settings-for-baseline-version-nine.html
release	australia
product	Instance Security Hardening Settings
classification	instance-security-hardening-settings
topic_type	concept
last_updated	2026-09-10
reading_time_minutes	41
breadcrumb	Updated hardening settingsBaseline versionsHardening settingsPlatform Security