---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable HTTP Only Cookie Flag \[Updated in Security Center 1.3\]

# Enable HTTP Only Cookie Flag \[Updated in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies.
Use the HTTPOnly attribute to prevent attacks, such as cross-site scripting, because it doesn't allow access to the cookie using a client-side script, such as JavaScript. It does not eliminate cross site scripting risks but does
eliminate some exploitation vectors.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-http-only-cookie-flag__section_more_information}

{#sc-http-only-cookie-flag__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.cookies.http_only |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Purpose | To mitigate the risk of client-side script accessing the protected cookie. |
| Recommended value | true |
| Default value | true |
| Security risk rating | 8 |
| Functional impact | This remediation adds an extra HTTPOnly flag in on session cookies, thus protecting them from being stolen. * If you have custom functionality that requires JavaScript to access the user's cookie, it breaks that functionality. It should not be the case under normal circumstances. * The ServiceNow AI Platform handles session management and there shouldn't be a reason for a custom script to access the user's cookies. {#sc-http-only-cookie-flag__ul_szq_5mp_pkb} |
| Security risk | (Moderate) Session cookies in the application authenticate an end user and provide implicit access permissions on the application. That means there is a need to secure them from being stolen or exported. HTTP Only flags protect the session cookies from JavaScript injections or cross site scripting vulnerabilities stealing them. |
| References | [Available system properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=australia&pubname=australia-platform-administration&ft:locale=en-US) |
[ ]

{#sc-http-only-cookie-flag__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).