---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\]

# Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires.
When an OAuth access token is issued, the response includes a cookie. Users can use this cookie to continue using a session even after the OAuth token used to create that session expires. Use the
glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled system property to prevent this.

Ensure the glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled system property exists in the System Properties \[sys_properties\] table, and is set to a value of
<kbd class="ph userinput">true</kbd>.

## More information {#sc-invalidate-session-after-oauth-token-expiration__section_qhx_1b1_xwb}

{#sc-invalidate-session-after-oauth-token-expiration__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.oauth.post.token.expiration.cookie_auth.disabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 6.8 * CVSS score: Medium * Security risk details: If an OAuth token is leaked or compromised, the lack of expiration would allow an attacker to use and extend the session via the created cookie. Malicious users can use sessions to access unauthorized resources and take unauthorized actions. Set this property to the secure value to eliminate this hidden session extension mechanism and reduce replay risk by enforcing token expiration. {#sc-invalidate-session-after-oauth-token-expiration__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | Impact when set to true: * Sessions end immediately when the access token expires. * Cookies no longer refresh session validity. * Clients must use refresh tokens or re-authenticate to obtain a new access token. {#sc-invalidate-session-after-oauth-token-expiration__ul_yfn_2gn_rhc} Potential Breakage: * Legacy clients or custom integrations relying on cookie-based session extension fail after token expiry. * Long-running jobs without token renewal logic may encounter 401 errors. {#sc-invalidate-session-after-oauth-token-expiration__ul_rlk_jgn_rhc} What Continues to Work: * Standard OAuth flows with refresh tokens. * Properly designed integrations that renew tokens proactively. {#sc-invalidate-session-after-oauth-token-expiration__ul_lws_4gn_rhc} |
[ ]

{#sc-invalidate-session-after-oauth-token-expiration__table_ajc_b43_3kb}