---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Require AJAXGlideRecord ACL checking \[Updated in Security Center 1.3\]

# Require AJAXGlideRecord ACL checking \[Updated in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Use the glide.script.secure.ajaxgliderecord property to perform
access control rule (ACL) validation when server-side records, such as tables, are accessed
using GlideAjax APIs within a client script.
From client scripts, it is possible to query arbitrary data from the server using the
AJAXGlideRecord ([GlideAjax - Client](https://www.servicenow.com/docs/access?context=c_GlideAjaxAPI&version=australia&pubname=australia-api-reference&ft:locale=en-US)) API, by using a syntax such as a server-side glide record. It is
a powerful and useful tool in many deployments.

If you choose to apply Access Control Lists (ACL) to GlideAjax API calls, you can only
query data to which the currently connected user has access. For example, if an ESS user
who has no rights to read the cmn_location table is logged in, any GlideAjax API call to
that table would fail.

If the ServiceNow AI Platform is running without GlideAjax ACL call checking, an API can
return information that the currently logged in user could not otherwise access.

Use GlideRecordSecure when querying data to ensure the highest level of security. GlideRecord relies on ACL enforcement through configurations whereas GlideRecordSecure applies stricter security controls. GlideRecordSecure
offers a more secure, out-of-the-box solution for handling sensitive data.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-enabling-ajaxgliderecord-acl-checking__section_more_information}

{#sc-enabling-ajaxgliderecord-acl-checking__table_ajc_b43_3kb__entry__2}{#sc-enabling-ajaxgliderecord-acl-checking__ph-instance-hardening}

| Attribute | Description |
|-|-|
| Property name | glide.script.secure.ajaxgliderecord |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Purpose | Ensure security ACLs are checked and validated even when the records are accessed through Client Side APIs. |
| Recommended value | true |
| Default value | true |
| Security risk rating | 8.1 |
| Functional impact | This remediation enforces the ACL relationship with server-side records when the requests are made using the AJAXGlideRecord API calls. If the ACL configuration is not properly configured, then there is potential impact. For more details on its impact, and how to identify it, see Refer to the [Audit and review client-side GlideRecord (AJAXGlideRecord) transactions \[KB0550828\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0550828) article in the HI Knowledge Base . |
| Security risk | (High) Through client scripts, it is possible to query arbitrary data from the server through the GlideAjax API. Server-side resources can be accessed without proper authorization, so using ACL validation helps the application validate the request based on the configured authorization. |
| Workaround | Ensure that proper ACLs are created for script includes, processors, and other entities used by a GlideAjax (AJAXGlideRecord) API so that it executes under proper authorization. Implement methods like `canRead ()`, `canWrite()`, `canCreate ()`, and `canDelete ()` to perform user authorization before accessing table records using GlideRecord. Another method is to use GlideRecordSecure. The class is inherited from the GlideRecord Server that performs the same functions as GlideRecord, and also enforces ACLs. |
| References | [Apply ACLs to AJAXGlideRecord (client-side Glide record)](https://servicenow-prod.fluidtopics.net/~S0jjI5xF4nug5Ltd8Jo5A "Use a system property to perform access control list (ACL) rule validation when server-side records (for example, tables) are accessed using GlideAjax APIs within a client script.") This property belongs to the same family of properties that secure and restrict execution of scripts originating from the client, such as glide.script.allow.ajaxevaluate. For more information, see [Enable AJAXEvaluate](https://servicenow-prod.fluidtopics.net/oF4JD9yBCmjSuJHfy6sPxQ "Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls."). |
[ ]

{#sc-enabling-ajaxgliderecord-acl-checking__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).