---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Tutorial: Configuring session validation

# Tutorial: Configuring session validation {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Configure session validation within the Adaptive Authentication framework to provide as an additional layer of protection for session or cookie hijacking.

## Vorbereitungen

Role required: adaptive_auth_admin

Plugin required: Adaptive Authentication (com.snc.adaptive_authentication)

To configure Session Validation, you must perform the following steps:

## Prozedur

1. Navigate to AllAdaptive AuthenticationAuthentication PoliciesAll Policies.
2. Select the Session Validation Policy in the Policies (<kbd class="ph userinput">sys_authentication_policy_list.do</kbd>) page.
3. Select Policy Inputs.
   1. Select New or Edit.
   2. Choose the kind of Policy Input (Filter Criteria) that you want to create.  
      Available options are IP, Role, and Group Filter Criteria. Let's choose IP Filter Criteria.
   3. Fill the form with the filter details and provide the IP Range.  

      To learn more about how to create an IP Filter, see [Create IP filter criteria](https://servicenow-prod.fluidtopics.net/88Zg0f1_fMOD5U6m39Zkpw "IP filter criteria allows you to filter users based on the user's IP addresses. You can configure an authentication policy to allow or deny access to a specific address or range of addresses.").
   4. Select Submit.
   {#use-ip-session-context__substeps_b2y_db5_rzb}
4. Select Policy Conditions on the Session Validation Policy page.
   1. Select New.
   2. Fill the form and set the Condition for the Policy Input.  
      Hinweis:  
      You can set the conditions to <kbd class="ph userinput">true</kbd> or <kbd class="ph userinput">false</kbd> based on the configuration of the policy input. In this example, it is set to <kbd class="ph userinput">true</kbd>. Setting the condition to true in this case allows only the user with the configured IP address to log in.
   {#use-ip-session-context__substeps_fmn_4c5_rzb}
5. Select the <kbd class="ph userinput">Active</kbd> check box to activate the policy after the Session Validation Policy is set up with policy inputs and conditions.  
6. Navigate to AllAdaptive AuthenticationAuthentication PoliciesProperties and enable the Session Validation property.  
7. Navigate to AllAdaptive AuthenticationAuth Policy ContextsSession Validation Context.
8. Set the Default Policy to Allow Policy or Deny Policy to set the session validation context according to the policy input and policy conditions.  
   Hinweis:  
   By default:
   * The Session Validation context is set to Allow Policy.
   * Allow Policy is selected as Session Validation Policy.
   * The Session Validation Context for an authentication policy can only be with Allow Policy.
   {#use-ip-session-context__ul_tpq_rj5_rzb}

## Ergebnisse

The configuration evaluates the login session based on the following:

* Restricts access to the ServiceNow® instance when hijackers copy a user's session cookies from one device to another to impersonate a session.
* Restricts the user's session access if they're using an insecure network.
{#use-ip-session-context__ul_hpd_311_pzb}