---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable UserCookie version 3.1 \[Updated in Security Center 2.0\]

# Enable UserCookie version 3.1 \[Updated in Security Center 2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.
UserCookie v3 is generated only when property glide.ui.secure.cookies.use_kmf is disabled. UserCookie v3 is not secure due to
storing secret key for HMAC in source code and identical for all customers. That can support
malicious actors to use this one secret key for attempts to hijacking user sessions. By
setting the property glide.ui.secure.cookies.use_kmf to true UserCookie
v3.1 will be used and secret key will be stored in security storage such as KMF.

## More information {#sc-enable-usercookie-version-3-1__section_ghv_dvg_1xb}

{#sc-enable-usercookie-version-3-1__table_hhv_dvg_1xb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.secure.cookies.use_kmf |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 7.1 * CVSS score: High * Security risk details: Setting this to false is a security vulnerability due to the secret key for hash-based message authentication codes (HMAC) being stored in the source code. {#sc-enable-usercookie-version-3-1__ul_ihv_dvg_1xb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-usercookie-version-3-1__table_hhv_dvg_1xb}