---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict access to GlideSystemUserSession scriptable API \[Updated in Security Center 1.3 and 2.0\]

# Restrict access to GlideSystemUserSession scriptable API \[Updated in Security Center 1.3 and 2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call
this method via script.
gs.addErrorMessageNoSanitizationMessaging() and
gs.addInfoMessageNoSanitization() are used within the scripting
environment for logging and notifications. Both of these are available in the sandbox if
this property is not set to the recommended value of false. The sandbox is a low
privileged scripting environment available to unauthenticated and no role users. Both of
these methods can be used to display unsanitized input to a user. Displaying unsanitized
input to the user is dangerous, as unsanitized input may contain dangerous code that
runs in the user's browser. This can be utilized for traditional reflected XSS attacks.
Reflected XSS attacks can be used in multiple scenarios, including session
hijacking.

Set glide.sandbox.usersession.allow_unsanitized_messages system property to false. If there is not record of this property in the System Properties \[sys_properties\] table, create
one.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-access-glidesystemusersession-scriptable-api__section_more_information}

{#sc-access-glidesystemusersession-scriptable-api__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.sandbox.usersession.allow_unsanitized_messages |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Purpose | This property will restrict unsanitized informational or error messages from being called in a sandboxed user session. |
| Type | Boolean |
| Recommended value | false |
| Default value | true |
| Security risk rating | 8.1 |
| Functional impact | Set the property with the value false will result in no message creation or logging should those functions get called. |
| Security risk | (High) Without appropriate sanitization, potentially dangerous content may be accessed and the unsanitized error function is available to script. |
| References | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
[ ]

{#sc-access-glidesystemusersession-scriptable-api__table_ajc_b43_3kb}