---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable HTTP response headers configuration

# Enable HTTP response headers configuration {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Reduce the risk of cookie/session-related hijacking of web apps using a system property.
If glide.http.headers_config.enabled isn't set to true, then response header configurations defined in the HTTP Response Headers \[sys_response_header\] table aren't used. Security related
HTTP response headers include Content Security Policy, which aids in XSS-related protections. For details on HTTP response headers, see [HTTP Response Headers](https://www.servicenow.com/docs/access?context=http-response-header&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US).

Verify that the property glide.http.headers_config.enabled is set to true.

## More information {#sc-enable-http-response-headers-configuration__section_qhx_1b1_xwb}

{#sc-enable-http-response-headers-configuration__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.http.headers_config.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 5.5 * CVSS score: Medium * Security Risk: The security risks of missing, incorrect, or weak HTTP response headers may allow for XSS, CSRF, and cookie/session related hijacking of web apps. {#sc-enable-http-response-headers-configuration__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-http-response-headers-configuration__table_ajc_b43_3kb}