---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit UI active session life span \[New in Security Center 1.3\]

# Limit UI active session life span \[New in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout.
Reduce the scope of potential security incidents by decreasing the lifespan of active HTTP sessions. The glide.ui.active.session.life_span system property enforces a maximum lifespan on active HTTP sessions
irrespective of inactive timeout. Longer maximum lifespans can allow an attacker to use a stolen session for a longer time, increasing the scope of a security incident. The default value of 0 disables timeout
of active sessions

Set the glide.ui.active.session.life_span to a value between 1 and 720. This value represents the time in minutes that HTTP sessions can remain active.  
Hinweis:  
The glide.ui.active.session.life_span is limited to UI session timeout.

## More information {#sc-limit-ui-active-session-life-span__section_qhx_1b1_xwb}

{#sc-limit-ui-active-session-life-span__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.active.session.life_span |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | integer |
| Recommended value | 1-720 |
| Default value | 0 |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: A larger maximum lifespan could allow an attacker to remain in a stolen session longer, increasing the possibility of a security incident. {#sc-limit-ui-active-session-life-span__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | Enforces max life-span on active authenticated HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions. The max life-span should be more than inactive timeout glide.ui.session_timeout (default 30 minutes). |
[ ]

{#sc-limit-ui-active-session-life-span__table_ajc_b43_3kb}