---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Prevent Reuse of REST API Sessions in UI/Web

# Prevent Reuse of REST API Sessions in UI/Web {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Prevent REST API session cookies from bypassing Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls using a system property.
Use the com.glide.processors.aprocessor.donot_reuse_api_session to help prevent the cookies associated with the session created through the REST API from being reused to initiate UI/web sessions.

Verify that com.glide.processors.aprocessor.donot_reuse_api_session exists in the System Properties \[sys_properties\] table and is set to <kbd class="ph userinput">true</kbd>.

## More information {#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__id_svc_vgm_rhc}

{#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.processors.aprocessor.donot_reuse_api_session |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.3 * CVSS score: Medium * Security risk details: Reusing REST API session cookies for a web session bypasses Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls. This bypass can be an escalation of intended privileges. SSO and MFA controls are important requirements to help prevent unauthorized access to data. {#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__ul_g1g_3sf_xwb} |
| Functional impact | When com.glide.processors.aprocessor.donot_reuse_api_session is set to true: * API session cookies can no longer be reused to initiate web sessions. * All web sessions require full authentication (SSO/MFA), regardless of any existing API session. {#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__ul_o14_qkm_rhc} Potential Breakage: * Custom integrations, scripts, or legacy workflows that relied on the ability to transition from an API session to a web session without re-authentication will fail. * Automated processes or tools that previously bypassed SSO/MFA using API session cookies are forced to complete the full authentication flow. * Users may experience unexpected authentication prompts if their workflows were implicitly relying on this behavior. {#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__ul_lj3_tkm_rhc} Before enabling, customers should review integrations and customizations: * Audit all integrations, scripts, and tools that interact with the instance via API and web interfaces. * Identify any that may be relying on session cookie reuse for seamless transitions between API and web sessions. {#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__ul_ks4_tlm_rhc} |
| Dependencies and prerequisites | None |
[ ]

{#sc-prevent-reuse-of-rest-api-sessions-in-ui-web__table_ajc_b43_3kb}