---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit guest's active session life span \[New in Security Center 1.3\]

# Limit guest's active session life span \[New in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.
The glide.guest.active.session.life_span property enforces a maximum lifespan on active guest HTTP sessions, irrespective of their session inactivity or the amount of time a user is inactive before their
session times out and closes.

The configured value is in minutes. A value of zero will disable timing out the active sessions. A larger value could allow an attacker to remain in a stolen session for longer, increasing the possibility of a security incident.
This property is limited to guest users, which have low privilege access to an instance.

To remediate this security vulnerability, set glide.guest.active.session.life_span to a value greater than 0 and less than or equal to 720.

## More information {#sc-limit-guests-active-session-life-span__section_qhx_1b1_xwb}

{#sc-limit-guests-active-session-life-span__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.guest.active.session.life_span |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | integer |
| Recommended value | 1-720 (minutes) |
| Default value | 0 |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: Setting the maximum lifespan to a large value gives a bad actor more time within an instance in the event that they steal a session. {#sc-limit-guests-active-session-life-span__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | This configuration enforces max life-span on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions. The max life-span should be more than the inactive timeout glide.ui.session_timeout (default 30 minutes). |
[ ]

{#sc-limit-guests-active-session-life-span__table_ajc_b43_3kb}